denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- import of strongswan-2.7.0

Browse Source 
- applied patch for charon
This commit is contained in:
Martin Willi
2006-04-28 07:14:48 +00:00
parent 52923c9acb
commit 997358a6c4
2043 changed files with 346842 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
linux/Documentation/Configure.help.fs2_0.patch
+65
View File
@@ -0,0 +1,65 @@
--- linux/Documentation/Configure.help.orig Tue Jan 9 16:29:20 2001
+++ linux/Documentation/Configure.help Fri Aug 9 14:47:14 2002
@@ -4979,2 +4979,62 @@
+IP Security Protocol (IPSEC) (EXPERIMENTAL)
+CONFIG_IPSEC
+ This unit is experimental code.
+ Pick 'y' for static linking, 'm' for module support or 'n' for none.
+ This option adds support for network layer packet encryption and/or
+ authentication with participating hosts. The standards start with:
+ RFCs 2411, 2407 and 2401. Others are mentioned where they refer to
+ specific features below. There are more pending which can be
+ found at: ftp://ftp.ietf.org/internet-drafts/draft-ietf-ipsec-*.
+ A description of each document can also be found at:
+ http://ietf.org/ids.by.wg/ipsec.html.
+ Their charter can be found at:
+ http://www.ietf.org/html.charters/ipsec-charter.html
+ Snapshots and releases of the current work can be found at:
+ http://www.freeswan.org/
+
+IPSEC: IP-in-IP encapsulation
+CONFIG_IPSEC_IPIP
+ This option provides support for tunnel mode IPSEC. It is recommended
+ to enable this.
+
+IPSEC: Authentication Header
+CONFIG_IPSEC_AH
+ This option provides support for the IPSEC Authentication Header
+ (IP protocol 51) which provides packet layer sender and content
+ authentication. It is recommended to enable this. RFC2402
+
+HMAC-MD5 algorithm
+CONFIG_IPSEC_AUTH_HMAC_MD5
+ Provides support for authentication using the HMAC MD5
+ algorithm with 96 bits of hash used as the authenticator. RFC2403
+
+HMAC-SHA1 algorithm
+CONFIG_IPSEC_AUTH_HMAC_SHA1
+ Provides support for Authentication Header using the HMAC SHA1
+ algorithm with 96 bits of hash used as the authenticator. RFC2404
+
+IPSEC: Encapsulating Security Payload
+CONFIG_IPSEC_ESP
+ This option provides support for the IPSEC Encapsulation Security
+ Payload (IP protocol 50) which provides packet layer content
+ hiding. It is recommended to enable this. RFC2406
+
+3DES algorithm
+CONFIG_IPSEC_ENC_3DES
+ Provides support for Encapsulation Security Payload protocol, using
+ the triple DES encryption algorithm. RFC2451
+
+IPSEC Debugging Option
+CONFIG_IPSEC_DEBUG
+ Enables IPSEC kernel debugging. It is further controlled by the
+ user space utility 'klipsdebug'.
+
+IPSEC Regression Testing option
+CONFIG_IPSEC_REGRESS
+ Enables IPSEC regression testing. Creates a number of switches in
+ /proc/sys/net/ipsec which cause various failure modes in KLIPS.
+ For more details see FreeSWAN source under
+ testing/doc/regression_options.txt.
+
# need an empty line after last entry, for sed script in Configure.
linux/Documentation/Configure.help.fs2_2.patch
+70
View File
@@ -0,0 +1,70 @@
--- /a3/kernel_sources/linux-2.2.20/Documentation/Configure.help Fri Nov 2 11:39:05 2001
+++ linux2.2/Documentation/Configure.help Mon Jul 29 15:42:26 2002
@@ -15237,5 +15237,66 @@
-#
+
+IP Security Protocol (IPSEC) (EXPERIMENTAL)
+CONFIG_IPSEC
+ This unit is experimental code.
+ Pick 'y' for static linking, 'm' for module support or 'n' for none.
+ This option adds support for network layer packet encryption and/or
+ authentication with participating hosts. The standards start with:
+ RFCs 2411, 2407 and 2401. Others are mentioned where they refer to
+ specific features below. There are more pending which can be found
+ at: ftp://ftp.ietf.org/internet-drafts/draft-ietf-ipsec-*.
+ A description of each document can also be found at:
+ http://ietf.org/ids.by.wg/ipsec.html.
+ Their charter can be found at:
+ http://www.ietf.org/html.charters/ipsec-charter.html
+ Snapshots and releases of the current work can be found at:
+ http://www.freeswan.org/
+
+IPSEC: IP-in-IP encapsulation
+CONFIG_IPSEC_IPIP
+ This option provides support for tunnel mode IPSEC. It is recommended
+ to enable this.
+
+IPSEC: Authentication Header
+CONFIG_IPSEC_AH
+ This option provides support for the IPSEC Authentication Header
+ (IP protocol 51) which provides packet layer sender and content
+ authentication. It is recommended to enable this. RFC2402
+
+HMAC-MD5 algorithm
+CONFIG_IPSEC_AUTH_HMAC_MD5
+ Provides support for authentication using the HMAC MD5
+ algorithm with 96 bits of hash used as the authenticator. RFC2403
+
+HMAC-SHA1 algorithm
+CONFIG_IPSEC_AUTH_HMAC_SHA1
+ Provides support for Authentication Header using the HMAC SHA1
+ algorithm with 96 bits of hash used as the authenticator. RFC2404
+
+IPSEC: Encapsulating Security Payload
+CONFIG_IPSEC_ESP
+ This option provides support for the IPSEC Encapsulation Security
+ Payload (IP protocol 50) which provides packet layer content
+ hiding. It is recommended to enable this. RFC2406
+
+3DES algorithm
+CONFIG_IPSEC_ENC_3DES
+ Provides support for Encapsulation Security Payload protocol, using
+ the triple DES encryption algorithm. RFC2451
+
+IPSEC Debugging Option
+CONFIG_IPSEC_DEBUG
+ Enables IPSEC kernel debugging. It is further controlled by the
+ user space utility 'klipsdebug'.
+
+IPSEC Regression Testing option
+CONFIG_IPSEC_REGRESS
+ Enables IPSEC regression testing. Creates a number of switches in
+ /proc/sys/net/ipsec which cause various failure modes in KLIPS.
+ For more details see FreeSWAN source under
+ testing/doc/regression_options.txt.
+
+#
# A couple of things I keep forgetting:
# capitalize: AppleTalk, Ethernet, DOS, DMA, FAT, FTP, Internet,
# Intel, IRQ, Linux, MSDOS, NetWare, NetWinder, NFS,
linux/Documentation/Configure.help.fs2_4.patch
+69
View File
@@ -0,0 +1,69 @@
--- linux/Documentation/Configure.help.orig Fri Dec 21 12:41:53 2001
+++ linux/Documentation/Configure.help Mon Jul 29 16:35:32 2002
@@ -24237,5 +24237,65 @@
-#
+IP Security Protocol (IPSEC) (EXPERIMENTAL)
+CONFIG_IPSEC
+ This unit is experimental code.
+ Pick 'y' for static linking, 'm' for module support or 'n' for none.
+ This option adds support for network layer packet encryption and/or
+ authentication with participating hosts. The standards start with:
+ RFCs 2411, 2407 and 2401. Others are mentioned where they refer to
+ specific features below. There are more pending which can be found
+ at: ftp://ftp.ietf.org/internet-drafts/draft-ietf-ipsec-*.
+ A description of each document can also be found at:
+ http://ietf.org/ids.by.wg/ipsec.html.
+ Their charter can be found at:
+ http://www.ietf.org/html.charters/ipsec-charter.html
+ Snapshots and releases of the current work can be found at:
+ http://www.freeswan.org/
+
+IPSEC: IP-in-IP encapsulation
+CONFIG_IPSEC_IPIP
+ This option provides support for tunnel mode IPSEC. It is recommended
+ to enable this.
+
+IPSEC: Authentication Header
+CONFIG_IPSEC_AH
+ This option provides support for the IPSEC Authentication Header
+ (IP protocol 51) which provides packet layer sender and content
+ authentication. It is recommended to enable this. RFC2402
+
+HMAC-MD5 algorithm
+CONFIG_IPSEC_AUTH_HMAC_MD5
+ Provides support for authentication using the HMAC MD5
+ algorithm with 96 bits of hash used as the authenticator. RFC2403
+
+HMAC-SHA1 algorithm
+CONFIG_IPSEC_AUTH_HMAC_SHA1
+ Provides support for Authentication Header using the HMAC SHA1
+ algorithm with 96 bits of hash used as the authenticator. RFC2404
+
+IPSEC: Encapsulating Security Payload
+CONFIG_IPSEC_ESP
+ This option provides support for the IPSEC Encapsulation Security
+ Payload (IP protocol 50) which provides packet layer content
+ hiding. It is recommended to enable this. RFC2406
+
+3DES algorithm
+CONFIG_IPSEC_ENC_3DES
+ Provides support for Encapsulation Security Payload protocol, using
+ the triple DES encryption algorithm. RFC2451
+
+IPSEC Debugging Option
+CONFIG_IPSEC_DEBUG
+ Enables IPSEC kernel debugging. It is further controlled by the
+ user space utility 'klipsdebug'.
+
+IPSEC Regression Testing option
+CONFIG_IPSEC_REGRESS
+ Enables IPSEC regression testing. Creates a number of switches in
+ /proc/sys/net/ipsec which cause various failure modes in KLIPS.
+ For more details see FreeSWAN source under
+ testing/doc/regression_options.txt.
+
+#
# A couple of things I keep forgetting:
# capitalize: AppleTalk, Ethernet, DOS, DMA, FAT, FTP, Internet,
# Intel, IRQ, ISDN, Linux, MSDOS, NetWare, NetWinder,
linux/Makefile
+32
View File
@@ -0,0 +1,32 @@
# FreeS/WAN subdir makefile
# Copyright (C) 1998-2001 Henry Spencer.
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
#
# RCSID $Id: Makefile,v 1.1 2004/03/15 20:35:25 as Exp $
FREESWANSRCDIR=..
#SUBDIRS=net/ipsec
include $(FREESWANSRCDIR)/Makefile.inc
def:
@echo "Please read doc/intro.html or INSTALL before running make"
@false
cleanall distclean mostlyclean realclean install programs checkprograms check clean spotless modules install_file_list:
@true
# @for d in $(SUBDIRS); \
# do \
# (cd $$d && $(MAKE) TOPDIR=${KERNELSRC} FREESWANSRCDIR=$(FREESWANSRCDIR)/.. $@ ) || exit 1 ; \
# done
linux/README.freeswan
+177
View File
@@ -0,0 +1,177 @@
*
* RCSID $Id: README.freeswan,v 1.1 2004/03/15 20:35:25 as Exp $
*
****************************************
* IPSEC for Linux, Release 2.xx series *
****************************************
1. Files
The contents of linux/net/ipsec/ (see below) join the linux kernel source tree.
as provided for higher up.
The programs/ directory contains the user-level utilities which you need
to run IPSEC. See the top-level top/INSTALL to compile and install them.
The test/ directory contains test scripts.
The doc/ directory contains -- what else -- documentation.
1.1. Kernel files
The following are found in net/ipsec/:
Makefile The Makefile
Config.in The configuration script for make menuconfig
defconfig Configuration defaults for first time.
radij.c General-purpose radix-tree operations
ipcomp.c IPCOMP interface code.
pfkey_v2.c PF_KEYv2 socket interface code.
pfkey_v2_parser.c PF_KEYv2 message parsing and processing code.
ipsec_init.c Initialization code, /proc interface.
ipsec_radij.c Interface with the radix tree code.
ipsec_netlink.c Interface with the netlink code.
ipsec_xform.c Routines and structures common to transforms.
ipsec_tunnel.c The outgoing packet processing code.
ipsec_rcv.c The incoming packet processing code.
ipsec_md5c.c Somewhat modified RSADSI MD5 C code.
ipsec_sha1.c Somewhat modified Steve Reid SHA-1 C code.
sysctl_net_ipsec.c /proc/sys/net/ipsec/* variable definitions.
version.c symbolic link to project version.
radij.h Headers for radij.c
ipcomp.h Headers used by IPCOMP code.
ipsec_radij.h Interface with the radix tree code.
ipsec_netlink.h Headers used by the netlink interface.
ipsec_encap.h Headers defining encapsulation structures.
ipsec_xform.h Transform headers.
ipsec_tunnel.h Headers used by tunneling code.
ipsec_ipe4.h Headers for the IP-in-IP code.
ipsec_ah.h Headers common to AH transforms.
ipsec_md5h.h RSADSI MD5 headers.
ipsec_sha1.h SHA-1 headers.
ipsec_esp.h Headers common to ESP transfroms.
ipsec_rcv.h Headers for incoming packet processing code.
1.2. User-level files.
The following are found in utils/:
eroute.c Create an "extended route" source code
spi.c Set up Security Associations source code
spigrp.c Link SPIs together source code.
tncfg.c Configure the tunneling features of the virtual interface
source code
klipsdebug.c Set/reset klips debugging features source code.
version.c symbolic link to project version.
eroute.8 Create an "extended route" manual page
spi.8 Set up Security Associations manual page
spigrp.8 Link SPIs together manual page
tncfg.8 Configure the tunneling features of the virtual interface
manual page
klipsdebug.8 Set/reset klips debugging features manual page
eroute.5 /proc/net/ipsec_eroute format manual page
spi.5 /proc/net/ipsec_spi format manual page
spigrp.5 /proc/net/ipsec_spigrp format manual page
tncfg.5 /proc/net/ipsec_tncfg format manual page
klipsdebug.5 /proc/net/ipsec_klipsdebug format manual page
version.5 /proc/net/ipsec_version format manual page
pf_key.5 /proc/net/pf_key format manual page
Makefile Utilities makefile.
*.8 Manpages for the respective utils.
1.3. Test files
The test scripts are locate in testing/ and and documentation is found
at doc/src/umltesting.html. Automated testing via "make check" is available
provided that the User-Mode-Linux patches are available.
*
* $Log: README.freeswan,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.11 2002/07/28 23:00:14 mcr
* removed docs on "test" directory.
* some slight "updates"
*
* Revision 1.10 2002/05/06 21:34:19 mcr
* Moved from linux/README,v
*
* Revision 1.9 2002/04/24 07:36:35 mcr
* Moved from ./klips/README,v
*
* Revision 1.8 2000/11/06 05:42:58 rgb
* Updated file list (had not been done in 2 years?).
*
* Revision 1.7 2000/08/21 17:30:09 rgb
* Remove any references to src/.
*
* Revision 1.6 1999/04/06 04:54:22 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.5 1998/11/25 04:54:34 rgb
* Updated files section to include newer transforms and other files.
*
* Revision 1.4 1998/05/01 03:47:17 rgb
* Minor cleanup of utils filenames overlooked in major overhaul.
*
* Revision 1.3 1998/05/01 03:40:31 rgb
* Major overhaul.
* Removed install/initialise section with pointers to top-level INSTALL.txt.
* Updated filelists and providing descriptions of all files.
* Removed usage example and moved it to doc/*_setup.txt.
*
* Revision 1.2 1998/04/09 03:01:13 henry
* INSTALL.txt moves up, loses its installation instructions, and turns
* into the klips README.
*
* Revision 1.1.1.1 1998/04/08 05:35:13 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
*
* Revision 0.7 rgb
* Cleaned up several transmission bugs.
*
* Revision 0.6 1997/09? ak
* Hooked in esp des-md5-96.
* Added copyrights.
*
* Revision 0.5 1997/06/03 04:28:46 ji
* Added transport mode.
* Added esp 3des-md5-96.
*
* Revision 0.4 1997/01/14 21:35:31 ji
* Added new transforms.
* Cleaned up the user-level programs.
*
* Revision 0.3 1996/11/20 11:59:33 ji
* *** empty log message ***
*
*
* New in this release (0.3; works with the 2.0.24 kernel)
*
* > Cleaned up a fair amount of crud.
* > Fixed truncated names of /proc/net entries.
* > Made RCS versioning visible to the external release.
* > Rationalized debugging facilities.
* > Rationalized untar directory structure.
* > Fixed non-incrementing IV in DES-CBC
* > Cleaned up this file a bit and provided additional examples
linux/crypto/ciphers/des/COPYRIGHT
+50
View File
@@ -0,0 +1,50 @@
Copyright (C) 1995-1997 Eric Young ([email protected])
All rights reserved.
This package is an DES implementation written by Eric Young ([email protected]).
The implementation was written so as to conform with MIT's libdes.
This library is free for commercial and non-commercial use as long as
the following conditions are aheared to. The following conditions
apply to all code found in this distribution.
Copyright remains Eric Young's, and as such any Copyright notices in
the code are not to be removed.
If this package is used in a product, Eric Young should be given attribution
as the author of that the SSL library. This can be in the form of a textual
message at program startup or in documentation (online or textual) provided
with the package.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. All advertising materials mentioning features or use of this software
must display the following acknowledgement:
This product includes software developed by Eric Young ([email protected])
THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
The license and distribution terms for any publically available version or
derivative of this code cannot be changed. i.e. this code cannot simply be
copied and put under another distrubution license
[including the GNU Public License.]
The reason behind this being stated in this direct manner is past
experience in code simply being copied and the attribution removed
from it and then being distributed as part of other packages. This
implementation was a non-trivial and unpaid effort.
linux/crypto/ciphers/des/INSTALL
+69
View File
@@ -0,0 +1,69 @@
Check the CC and CFLAGS lines in the makefile
If your C library does not support the times(3) function, change the
#define TIMES to
#undef TIMES in speed.c
If it does, check the HZ value for the times(3) function.
If your system does not define CLK_TCK it will be assumed to
be 100.0.
If possible use gcc v 2.7.?
Turn on the maximum optimising (normally '-O3 -fomit-frame-pointer' for gcc)
In recent times, some system compilers give better performace.
type 'make'
run './destest' to check things are ok.
run './rpw' to check the tty code for reading passwords works.
run './speed' to see how fast those optimisations make the library run :-)
run './des_opts' to determin the best compile time options.
The output from des_opts should be put in the makefile options and des_enc.c
should be rebuilt. For 64 bit computers, do not use the DES_PTR option.
For the DEC Alpha, edit des.h and change DES_LONG to 'unsigned int'
and then you can use the 'DES_PTR' option.
The file options.txt has the options listed for best speed on quite a
few systems. Look and the options (UNROLL, PTR, RISC2 etc) and then
turn on the relevent option in the Makefile
There are some special Makefile targets that make life easier.
make cc - standard cc build
make gcc - standard gcc build
make x86-elf - x86 assembler (elf), linux-elf.
make x86-out - x86 assembler (a.out), FreeBSD
make x86-solaris- x86 assembler
make x86-bsdi - x86 assembler (a.out with primative assembler).
If at all possible use the assembler (for Windows NT/95, use
asm/win32.obj to link with). The x86 assembler is very very fast.
A make install will by default install
libdes.a in /usr/local/lib/libdes.a
des in /usr/local/bin/des
des_crypt.man in /usr/local/man/man3/des_crypt.3
des.man in /usr/local/man/man1/des.1
des.h in /usr/include/des.h
des(1) should be compatible with sunOS's but I have been unable to
test it.
These routines should compile on MSDOS, most 32bit and 64bit version
of Unix (BSD and SYSV) and VMS, without modification.
The only problems should be #include files that are in the wrong places.
These routines can be compiled under MSDOS.
I have successfully encrypted files using des(1) under MSDOS and then
decrypted the files on a SparcStation.
I have been able to compile and test the routines with
Microsoft C v 5.1 and Turbo C v 2.0.
The code in this library is in no way optimised for the 16bit
operation of MSDOS.
When building for glibc, ignore all of the above and just unpack into
glibc-1.??/des and then gmake as per normal.
As a final note on performace. Certain CPUs like sparcs and Alpha often give
a %10 speed difference depending on the link order. It is rather anoying
when one program reports 'x' DES encrypts a second and another reports
'x*0.9' the speed.
linux/crypto/ciphers/des/Makefile.objs
+20
View File
@@ -0,0 +1,20 @@
obj-$(CONFIG_IPSEC_ENC_3DES) += cbc_enc.o
#obj-$(CONFIG_IPSEC_ENC_3DES) += des_opts.o
obj-$(CONFIG_IPSEC_ENC_3DES) += ecb_enc.o
#obj-$(CONFIG_IPSEC_ENC_3DES) += fcrypt.o
obj-$(CONFIG_IPSEC_ENC_3DES) += set_key.o
ifeq ($(strip ${SUBARCH}),)
SUBARCH:=${ARCH}
endif
ifeq (${SUBARCH},i386)
obj-$(CONFIG_IPSEC_ENC_3DES) += dx86unix.o
else
obj-$(CONFIG_IPSEC_ENC_3DES) += des_enc.o
endif
linux/crypto/ciphers/des/README
+54
View File
@@ -0,0 +1,54 @@
libdes, Version 4.01 10-Jan-97
Copyright (c) 1997, Eric Young
All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms specified in COPYRIGHT.
--
The primary ftp site for this library is
ftp://ftp.psy.uq.oz.au/pub/Crypto/DES/libdes-x.xx.tar.gz
libdes is now also shipped with SSLeay. Primary ftp site of
ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/SSLeay-x.x.x.tar.gz
The best way to build this library is to build it as part of SSLeay.
This kit builds a DES encryption library and a DES encryption program.
It supports ecb, cbc, ofb, cfb, triple ecb, triple cbc, triple ofb,
triple cfb, desx, and MIT's pcbc encryption modes and also has a fast
implementation of crypt(3).
It contains support routines to read keys from a terminal,
generate a random key, generate a key from an arbitrary length string,
read/write encrypted data from/to a file descriptor.
The implementation was written so as to conform with the manual entry
for the des_crypt(3) library routines from MIT's project Athena.
destest should be run after compilation to test the des routines.
rpw should be run after compilation to test the read password routines.
The des program is a replacement for the sun des command. I believe it
conforms to the sun version.
The Imakefile is setup for use in the kerberos distribution.
These routines are best compiled with gcc or any other good
optimising compiler.
Just turn you optimiser up to the highest settings and run destest
after the build to make sure everything works.
I believe these routines are close to the fastest and most portable DES
routines that use small lookup tables (4.5k) that are publicly available.
The fcrypt routine is faster than ufc's fcrypt (when compiling with
gcc2 -O2) on the sparc 2 (1410 vs 1270) but is not so good on other machines
(on a sun3/260 168 vs 336). It is a function of CPU on chip cache size.
[ 10-Jan-97 and a function of an incorrect speed testing program in
ufc which gave much better test figures that reality ].
It is worth noting that on sparc and Alpha CPUs, performance of the DES
library can vary by upto %10 due to the positioning of files after application
linkage.
Eric Young ([email protected])
linux/crypto/ciphers/des/README.freeswan
+33
View File
@@ -0,0 +1,33 @@
The only changes the FreeS/WAN project has made to libdes-lite 4.04b are:
We #ifdef-ed the declaration of DES_LONG in des.h, so it's more efficient
on the Alpha, instead of just noting the issue in a comment.
We #ifdef-ed out the des_options() function in ecb_enc.c, because we don't
use it, and its call to sprintf() can cause subtle difficulties when KLIPS
is built as a module (depending on details of Linux configuration options).
We changed some instances of CC=$(CC) in the Makefile to CC='$(CC)' to make
it cope better with Linux kernel Makefile stupidities, and took out an
explicit CC=gcc (unwise on systems with strange compilers).
We deleted some references to <stdio.h> and <stdlib.h>, and a declaration
of one function found only in the full libdes (not in libdes-lite), to
avoid dragging in bits of stdio/stdlib unnecessarily. (Our thanks to Hans
Schultz for spotting this and pointing out the fixes.)
We deleted a couple of .obj files in the asm subdirectory, which appear to
have been included in the original library by accident.
We have added an include of our Makefile.inc file, to permit overriding
things like choice of compiler (although the libdes Makefile would
probably need some work to make this effective).
Note that Eric Young is no longer at the email address listed in these
files, and is (alas) no longer working on free crypto software.
This file is RCSID $Id: README.freeswan,v 1.1 2004/03/15 20:35:25 as Exp $
linux/crypto/ciphers/des/VERSION
+406
View File
@@ -0,0 +1,406 @@
Version 4.04
Fixed a few tests in destest. Also added x86 assember for
des_ncbc_encrypt() which is the standard cbc mode function.
This makes a very very large performace difference.
Ariel Glenn [email protected] reports that the terminal
'turn echo off' can return (errno == EINVAL) under solaris
when redirection is used. So I now catch that as well as ENOTTY.
Version 4.03
Left a static out of enc_write.c, which caused to buffer to be
continiously malloc()ed. Does anyone use these functions? I keep
on feeling like removing them since I only had these in there
for a version of kerberised login. Anyway, this was pointed out
by Theo de Raadt <[email protected]>
The 'n' bit ofb code was wrong, it was not shifting the shift
register. It worked correctly for n == 64. Thanks to
Gigi Ankeny <[email protected]> for pointing this one out.
Version 4.02
I was doing 'if (memcmp(weak_keys[i],key,sizeof(key)) == 0)'
when checking for weak keys which is wrong :-(, pointed out by
Markus F.X.J. Oberhumer <[email protected]>.
Version 4.01
Even faster inner loop in the DES assembler for x86 and a modification
for IP/FP which is faster on x86. Both of these changes are
from Svend Olaf Mikkelsen <[email protected]>. His
changes make the assembler run %40 faster on a pentium. This is just
a case of getting the instruction sequence 'just right'.
All credit to 'Svend' :-)
Quite a few special x86 'make' targets.
A libdes-l (lite) distribution.
Version 4.00
After a bit of a pause, I'll up the major version number since this
is mostly a performace release. I've added x86 assembler and
added more options for performance. A %28 speedup for gcc
on a pentium and the assembler is a %50 speedup.
MIPS CPU's, sparc and Alpha are the main CPU's with speedups.
Run des_opts to work out which options should be used.
DES_RISC1/DES_RISC2 use alternative inner loops which use
more registers but should give speedups on any CPU that does
dual issue (pentium). DES_UNROLL unrolls the inner loop,
which costs in code size.
Version 3.26
I've finally removed one of the shifts in D_ENCRYPT. This
meant I've changed the des_SPtrans table (spr.h), the set_key()
function and some things in des_enc.c. This has definitly
made things faster :-). I've known about this one for some
time but I've been too lazy to follow it up :-).
Noticed that in the D_ENCRYPT() macro, we can just do L^=(..)^(..)^..
instead of L^=((..)|(..)|(..).. This should save a register at
least.
Assember for x86. The file to replace is des_enc.c, which is replaced
by one of the assembler files found in asm. Look at des/asm/readme
for more info.
/* Modification to fcrypt so it can be compiled to support
HPUX 10.x's long password format, define -DLONGCRYPT to use this.
Thanks to Jens Kupferschmidt <[email protected]>. */
SIGWINCH case put in des_read_passwd() so the function does not
'exit' if this function is recieved.
Version 3.25 17/07/96
Modified read_pwd.c so that stdin can be read if not a tty.
Thanks to Jeff Barber <[email protected]> for the patches.
des_init_random_number_generator() shortened due to VMS linker
limits.
Added RSA's DESX cbc mode. It is a form of cbc encryption, with 2
8 byte quantites xored before and after encryption.
des_xcbc_encryption() - the name is funny to preserve the des_
prefix on all functions.
Version 3.24 20/04/96
The DES_PTR macro option checked and used by SSLeay configuration
Version 3.23 11/04/96
Added DES_LONG. If defined to 'unsigned int' on the DEC Alpha,
it gives a %20 speedup :-)
Fixed the problem with des.pl under perl5. The patches were
sent by Ed Kubaitis ([email protected]).
if fcrypt.c, changed values to handle illegal salt values the way
normal crypt() implementations do. Some programs apparently use
them :-(. The patch was sent by Bjorn Gronvall <[email protected]>
Version 3.22 29/11/95
Bug in des(1), an error with the uuencoding stuff when the
'data' is small, thanks to Geoff Keating <[email protected]>
for the patch.
Version 3.21 22/11/95
After some emailing back and forth with
Colin Plumb <[email protected]>, I've tweaked a few things
and in a future version I will probably put in some of the
optimisation he suggested for use with the DES_USE_PTR option.
Extra routines from Mark Murray <[email protected]> for use in
freeBSD. They mostly involve random number generation for use
with kerberos. They involve evil machine specific system calls
etc so I would normally suggest pushing this stuff into the
application and/or using RAND_seed()/RAND_bytes() if you are
using this DES library as part of SSLeay.
Redone the read_pw() function so that it is cleaner and
supports termios, thanks to Sameer Parekh <[email protected]>
for the initial patches for this.
Renamed 3ecb_encrypt() to ecb3_encrypt(). This has been
done just to make things more consistent.
I have also now added triple DES versions of cfb and ofb.
Version 3.20
Damn, Damn, Damn, as pointed out by [email protected],
my des_random_seed() function was only copying 4 bytes of the
passed seed into the init structure. It is now fixed to copy 8.
My own suggestion is to used something like MD5 :-)
Version 3.19
While looking at my code one day, I though, why do I keep on
calling des_encrypt(in,out,ks,enc) when every function that
calls it has in and out the same. So I dropped the 'out'
parameter, people should not be using this function.
Version 3.18 30/08/95
Fixed a few bit with the distribution and the filenames.
3.17 had been munged via a move to DOS and back again.
NO CODE CHANGES
Version 3.17 14/07/95
Fixed ede3 cbc which I had broken in 3.16. I have also
removed some unneeded variables in 7-8 of the routines.
Version 3.16 26/06/95
Added des_encrypt2() which does not use IP/FP, used by triple
des routines. Tweaked things a bit elsewhere. %13 speedup on
sparc and %6 on a R4400 for ede3 cbc mode.
Version 3.15 06/06/95
Added des_ncbc_encrypt(), it is des_cbc mode except that it is
'normal' and copies the new iv value back over the top of the
passed parameter.
CHANGED des_ede3_cbc_encrypt() so that it too now overwrites
the iv. THIS WILL BREAK EXISTING CODE, but since this function
only new, I feel I can change it, not so with des_cbc_encrypt :-(.
I need to update the documentation.
Version 3.14 31/05/95
New release upon the world, as part of my SSL implementation.
New copyright and usage stuff. Basically free for all to use
as long as you say it came from me :-)
Version 3.13 31/05/95
A fix in speed.c, if HZ is not defined, I set it to 100.0
which is reasonable for most unixes except SunOS 4.x.
I now have a #ifdef sun but timing for SunOS 4.x looked very
good :-(. At my last job where I used SunOS 4.x, it was
defined to be 60.0 (look at the old INSTALL documentation), at
the last release had it changed to 100.0 since I now work with
Solaris2 and SVR4 boxes.
Thanks to Rory Chisholm <[email protected]> for pointing this
one out.
Version 3.12 08/05/95
As pointed out by The Crypt Keeper <[email protected]>,
my D_ENCRYPT macro in crypt() had an un-necessary variable.
It has been removed.
Version 3.11 03/05/95
Added des_ede3_cbc_encrypt() which is cbc mode des with 3 keys
and one iv. It is a standard and I needed it for my SSL code.
It makes more sense to use this for triple DES than
3cbc_encrypt(). I have also added (or should I say tested :-)
cfb64_encrypt() which is cfb64 but it will encrypt a partial
number of bytes - 3 bytes in 3 bytes out. Again this is for
my SSL library, as a form of encryption to use with SSL
telnet.
Version 3.10 22/03/95
Fixed a bug in 3cbc_encrypt() :-(. When making repeated calls
to cbc3_encrypt, the 2 iv values that were being returned to
be used in the next call were reversed :-(.
Many thanks to Bill Wade <[email protected]> for pointing out
this error.
Version 3.09 01/02/95
Fixed des_random_key to far more random, it was rather feeble
with regards to picking the initial seed. The problem was
pointed out by Olaf Kirch <[email protected]>.
Version 3.08 14/12/94
Added Makefile.PL so libdes can be built into perl5.
Changed des_locl.h so RAND is always defined.
Version 3.07 05/12/94
Added GNUmake and stuff so the library can be build with
glibc.
Version 3.06 30/08/94
Added rpc_enc.c which contains _des_crypt. This is for use in
secure_rpc v 4.0
Finally fixed the cfb_enc problems.
Fixed a few parameter parsing bugs in des (-3 and -b), thanks
to Rob McMillan <[email protected]>
Version 3.05 21/04/94
for unsigned long l; gcc does not produce ((l>>34) == 0)
This causes bugs in cfb_enc.
Thanks to Hadmut Danisch <[email protected]>
Version 3.04 20/04/94
Added a version number to des.c and libdes.a
Version 3.03 12/01/94
Fixed a bug in non zero iv in 3cbc_enc.
Version 3.02 29/10/93
I now work in a place where there are 6+ architectures and 14+
OS versions :-).
Fixed TERMIO definition so the most sys V boxes will work :-)
Release upon comp.sources.misc
Version 3.01 08/10/93
Added des_3cbc_encrypt()
Version 3.00 07/10/93
Fixed up documentation.
quad_cksum definitely compatible with MIT's now.
Version 2.30 24/08/93
Triple DES now defaults to triple cbc but can do triple ecb
with the -b flag.
Fixed some MSDOS uuen/uudecoding problems, thanks to
Added prototypes.
Version 2.22 29/06/93
Fixed a bug in des_is_weak_key() which stopped it working :-(
thanks to [email protected].
Version 2.21 03/06/93
des(1) with no arguments gives quite a bit of help.
Added -c (generate ckecksum) flag to des(1).
Added -3 (triple DES) flag to des(1).
Added cfb and ofb routines to the library.
Version 2.20 11/03/93
Added -u (uuencode) flag to des(1).
I have been playing with byte order in quad_cksum to make it
compatible with MIT's version. All I can say is avid this
function if possible since MIT's output is endian dependent.
Version 2.12 14/10/92
Added MSDOS specific macro in ecb_encrypt which gives a %70
speed up when the code is compiled with turbo C.
Version 2.11 12/10/92
Speedup in set_key (recoding of PC-1)
I now do it in 47 simple operations, down from 60.
Thanks to John Fletcher ([email protected])
for motivating me to look for a faster system :-)
The speedup is probably less that 1% but it is still 13
instructions less :-).
Version 2.10 06/10/92
The code now works on the 64bit ETA10 and CRAY without modifications or
#defines. I believe the code should work on any machine that
defines long, int or short to be 8 bytes long.
Thanks to Shabbir J. Safdar ([email protected])
for helping me fix the code to run on 64bit machines (he had
access to an ETA10).
Thanks also to John Fletcher <[email protected]>
for testing the routines on a CRAY.
read_password.c has been renamed to read_passwd.c
string_to_key.c has been renamed to string2key.c
Version 2.00 14/09/92
Made mods so that the library should work on 64bit CPU's.
Removed all my uchar and ulong defs. To many different
versions of unix define them in their header files in too many
different combinations :-)
IRIX - Sillicon Graphics mods (mostly in read_password.c).
Thanks to Andrew Daviel ([email protected])
Version 1.99 26/08/92
Fixed a bug or 2 in enc_read.c
Fixed a bug in enc_write.c
Fixed a pseudo bug in fcrypt.c (very obscure).
Version 1.98 31/07/92
Support for the ETA10. This is a strange machine that defines
longs and ints as 8 bytes and shorts as 4 bytes.
Since I do evil things with long * that assume that they are 4
bytes. Look in the Makefile for the option to compile for
this machine. quad_cksum appears to have problems but I
will don't have the time to fix it right now, and this is not
a function that uses DES and so will not effect the main uses
of the library.
Version 1.97 20/05/92 eay
Fixed the Imakefile and made some changes to des.h to fix some
problems when building this package with Kerberos v 4.
Version 1.96 18/05/92 eay
Fixed a small bug in string_to_key() where problems could
occur if des_check_key was set to true and the string
generated a weak key.
Patch2 posted to comp.sources.misc
Version 1.95 13/05/92 eay
Added an alternative version of the D_ENCRYPT macro in
ecb_encrypt and fcrypt. Depending on the compiler, one version or the
other will be faster. This was inspired by
Dana How <[email protected]>, and her pointers about doing the
*(ulong *)((uchar *)ptr+(value&0xfc))
vs
ptr[value&0x3f]
to stop the C compiler doing a <<2 to convert the long array index.
Version 1.94 05/05/92 eay
Fixed an incompatibility between my string_to_key and the MIT
version. When the key is longer than 8 chars, I was wrapping
with a different method. To use the old version, define
OLD_STR_TO_KEY in the makefile. Thanks to
[email protected] (Viktor Dukhovni).
Version 1.93 28/04/92 eay
Fixed the VMS mods so that echo is now turned off in
read_password. Thanks again to [email protected].
MSDOS support added. The routines can be compiled with
Turbo C (v2.0) and MSC (v5.1). Make sure MSDOS is defined.
Patch1 posted to comp.sources.misc
Version 1.92 13/04/92 eay
Changed D_ENCRYPT so that the rotation of R occurs outside of
the loop. This required rotating all the longs in sp.h (now
called spr.h). Thanks to Richard Outerbridge <[email protected]>
speed.c has been changed so it will work without SIGALRM. If
times(3) is not present it will try to use ftime() instead.
Version 1.91 08/04/92 eay
Added -E/-D options to des(1) so it can use string_to_key.
Added SVR4 mods suggested by [email protected]
Added VMS mods suggested by [email protected]. If
anyone knows how to turn of tty echo in VMS please tell me or
implement it yourself :-).
Changed FILE *IN/*OUT to *DES_IN/*DES_OUT since it appears VMS
does not like IN/OUT being used.
Libdes posted to comp.sources.misc
Version 1.9 24/03/92 eay
Now contains a fast small crypt replacement.
Added des(1) command.
Added des_rw_mode so people can use cbc encryption with
enc_read and enc_write.
Version 1.8 15/10/91 eay
Bug in cbc_cksum.
Many thanks to Keith Reynolds ([email protected]) for pointing this
one out.
Version 1.7 24/09/91 eay
Fixed set_key :-)
set_key is 4 times faster and takes less space.
There are a few minor changes that could be made.
Version 1.6 19/09/1991 eay
Finally go IP and FP finished.
Now I need to fix set_key.
This version is quite a bit faster that 1.51
Version 1.52 15/06/1991 eay
20% speedup in ecb_encrypt by changing the E bit selection
to use 2 32bit words. This also required modification of the
sp table. There is still a way to speedup the IP and IP-1
(hints from [email protected]) still working on this one :-(.
Version 1.51 07/06/1991 eay
Faster des_encrypt by loop unrolling
Fixed bug in quad_cksum.c (thanks to [email protected])
Version 1.50 28/05/1991 eay
Optimised the code a bit more for the sparc. I have improved the
speed of the inner des_encrypt by speeding up the initial and
final permutations.
Version 1.40 23/10/1990 eay
Fixed des_random_key, it did not produce a random key :-(
Version 1.30 2/10/1990 eay
Have made des_quad_cksum the same as MIT's, the full package
should be compatible with MIT's
Have tested on a DECstation 3100
Still need to fix des_set_key (make it faster).
Does des_cbc_encrypts at 70.5k/sec on a 3100.
Version 1.20 18/09/1990 eay
Fixed byte order dependencies.
Fixed (I hope) all the word alignment problems.
Speedup in des_ecb_encrypt.
Version 1.10 11/09/1990 eay
Added des_enc_read and des_enc_write.
Still need to fix des_quad_cksum.
Still need to document des_enc_read and des_enc_write.
Version 1.00 27/08/1990 eay
linux/crypto/ciphers/des/asm/crypt586.pl
+204
View File
@@ -0,0 +1,204 @@
#!/usr/bin/perl
#
# The inner loop instruction sequence and the IP/FP modifications are from
# Svend Olaf Mikkelsen <[email protected]>
# I've added the stuff needed for crypt() but I've not worried about making
# things perfect.
#
push(@INC,"perlasm","../../perlasm");
require "x86asm.pl";
&asm_init($ARGV[0],"crypt586.pl");
$L="edi";
$R="esi";
&external_label("des_SPtrans");
&fcrypt_body("fcrypt_body");
&asm_finish();
sub fcrypt_body
{
local($name,$do_ip)=@_;
&function_begin($name,"EXTRN _des_SPtrans:DWORD");
&comment("");
&comment("Load the 2 words");
$ks="ebp";
&xor( $L, $L);
&xor( $R, $R);
&mov($ks,&wparam(1));
&push(25); # add a variable
&set_label("start");
for ($i=0; $i<16; $i+=2)
{
&comment("");
&comment("Round $i");
&D_ENCRYPT($i,$L,$R,$i*2,$ks,"des_SPtrans","eax","ebx","ecx","edx");
&comment("");
&comment("Round ".sprintf("%d",$i+1));
&D_ENCRYPT($i+1,$R,$L,($i+1)*2,$ks,"des_SPtrans","eax","ebx","ecx","edx");
}
&mov("ebx", &swtmp(0));
&mov("eax", $L);
&dec("ebx");
&mov($L, $R);
&mov($R, "eax");
&mov(&swtmp(0), "ebx");
&jnz(&label("start"));
&comment("");
&comment("FP");
&mov("edx",&wparam(0));
&FP_new($R,$L,"eax",3);
&mov(&DWP(0,"edx","",0),"eax");
&mov(&DWP(4,"edx","",0),$L);
&pop("ecx"); # remove variable
&function_end($name);
}
sub D_ENCRYPT
{
local($r,$L,$R,$S,$ks,$desSP,$u,$tmp1,$tmp2,$t)=@_;
&mov( $u, &wparam(2)); # 2
&mov( $t, $R);
&shr( $t, 16); # 1
&mov( $tmp2, &wparam(3)); # 2
&xor( $t, $R); # 1
&and( $u, $t); # 2
&and( $t, $tmp2); # 2
&mov( $tmp1, $u);
&shl( $tmp1, 16); # 1
&mov( $tmp2, $t);
&shl( $tmp2, 16); # 1
&xor( $u, $tmp1); # 2
&xor( $t, $tmp2); # 2
&mov( $tmp1, &DWP(&n2a($S*4),$ks,"",0)); # 2
&xor( $u, $tmp1);
&mov( $tmp2, &DWP(&n2a(($S+1)*4),$ks,"",0)); # 2
&xor( $u, $R);
&xor( $t, $R);
&xor( $t, $tmp2);
&and( $u, "0xfcfcfcfc" ); # 2
&xor( $tmp1, $tmp1); # 1
&and( $t, "0xcfcfcfcf" ); # 2
&xor( $tmp2, $tmp2);
&movb( &LB($tmp1), &LB($u) );
&movb( &LB($tmp2), &HB($u) );
&rotr( $t, 4 );
&mov( $ks, &DWP(" $desSP",$tmp1,"",0));
&movb( &LB($tmp1), &LB($t) );
&xor( $L, $ks);
&mov( $ks, &DWP("0x200+$desSP",$tmp2,"",0));
&xor( $L, $ks);
&movb( &LB($tmp2), &HB($t) );
&shr( $u, 16);
&mov( $ks, &DWP("0x100+$desSP",$tmp1,"",0));
&xor( $L, $ks);
&movb( &LB($tmp1), &HB($u) );
&shr( $t, 16);
&mov( $ks, &DWP("0x300+$desSP",$tmp2,"",0));
&xor( $L, $ks);
&mov( $ks, &wparam(1));
&movb( &LB($tmp2), &HB($t) );
&and( $u, "0xff" );
&and( $t, "0xff" );
&mov( $tmp1, &DWP("0x600+$desSP",$tmp1,"",0));
&xor( $L, $tmp1);
&mov( $tmp1, &DWP("0x700+$desSP",$tmp2,"",0));
&xor( $L, $tmp1);
&mov( $tmp1, &DWP("0x400+$desSP",$u,"",0));
&xor( $L, $tmp1);
&mov( $tmp1, &DWP("0x500+$desSP",$t,"",0));
&xor( $L, $tmp1);
}
sub n2a
{
sprintf("%d",$_[0]);
}
# now has a side affect of rotating $a by $shift
sub R_PERM_OP
{
local($a,$b,$tt,$shift,$mask,$last)=@_;
&rotl( $a, $shift ) if ($shift != 0);
&mov( $tt, $a );
&xor( $a, $b );
&and( $a, $mask );
if ($notlast eq $b)
{
&xor( $b, $a );
&xor( $tt, $a );
}
else
{
&xor( $tt, $a );
&xor( $b, $a );
}
&comment("");
}
sub IP_new
{
local($l,$r,$tt,$lr)=@_;
&R_PERM_OP($l,$r,$tt, 4,"0xf0f0f0f0",$l);
&R_PERM_OP($r,$tt,$l,20,"0xfff0000f",$l);
&R_PERM_OP($l,$tt,$r,14,"0x33333333",$r);
&R_PERM_OP($tt,$r,$l,22,"0x03fc03fc",$r);
&R_PERM_OP($l,$r,$tt, 9,"0xaaaaaaaa",$r);
if ($lr != 3)
{
if (($lr-3) < 0)
{ &rotr($tt, 3-$lr); }
else { &rotl($tt, $lr-3); }
}
if ($lr != 2)
{
if (($lr-2) < 0)
{ &rotr($r, 2-$lr); }
else { &rotl($r, $lr-2); }
}
}
sub FP_new
{
local($l,$r,$tt,$lr)=@_;
if ($lr != 2)
{
if (($lr-2) < 0)
{ &rotl($r, 2-$lr); }
else { &rotr($r, $lr-2); }
}
if ($lr != 3)
{
if (($lr-3) < 0)
{ &rotl($l, 3-$lr); }
else { &rotr($l, $lr-3); }
}
&R_PERM_OP($l,$r,$tt, 0,"0xaaaaaaaa",$r);
&R_PERM_OP($tt,$r,$l,23,"0x03fc03fc",$r);
&R_PERM_OP($l,$r,$tt,10,"0x33333333",$l);
&R_PERM_OP($r,$tt,$l,18,"0xfff0000f",$l);
&R_PERM_OP($l,$tt,$r,12,"0xf0f0f0f0",$r);
&rotr($tt , 4);
}
linux/crypto/ciphers/des/asm/des-586.pl
+251
View File
@@ -0,0 +1,251 @@
#!/usr/bin/perl
#
# The inner loop instruction sequence and the IP/FP modifications are from
# Svend Olaf Mikkelsen <[email protected]>
#
push(@INC,"perlasm","../../perlasm");
require "x86asm.pl";
require "cbc.pl";
require "desboth.pl";
# base code is in microsft
# op dest, source
# format.
#
&asm_init($ARGV[0],"des-586.pl");
$L="edi";
$R="esi";
&external_label("des_SPtrans");
&des_encrypt("des_encrypt",1);
&des_encrypt("des_encrypt2",0);
&des_encrypt3("des_encrypt3",1);
&des_encrypt3("des_decrypt3",0);
&cbc("des_ncbc_encrypt","des_encrypt","des_encrypt",0,4,5,3,5,-1);
&cbc("des_ede3_cbc_encrypt","des_encrypt3","des_decrypt3",0,6,7,3,4,5);
&asm_finish();
sub des_encrypt
{
local($name,$do_ip)=@_;
&function_begin_B($name,"EXTRN _des_SPtrans:DWORD");
&push("esi");
&push("edi");
&comment("");
&comment("Load the 2 words");
$ks="ebp";
if ($do_ip)
{
&mov($R,&wparam(0));
&xor( "ecx", "ecx" );
&push("ebx");
&push("ebp");
&mov("eax",&DWP(0,$R,"",0));
&mov("ebx",&wparam(2)); # get encrypt flag
&mov($L,&DWP(4,$R,"",0));
&comment("");
&comment("IP");
&IP_new("eax",$L,$R,3);
}
else
{
&mov("eax",&wparam(0));
&xor( "ecx", "ecx" );
&push("ebx");
&push("ebp");
&mov($R,&DWP(0,"eax","",0));
&mov("ebx",&wparam(2)); # get encrypt flag
&rotl($R,3);
&mov($L,&DWP(4,"eax","",0));
&rotl($L,3);
}
&mov( $ks, &wparam(1) );
&cmp("ebx","0");
&je(&label("start_decrypt"));
for ($i=0; $i<16; $i+=2)
{
&comment("");
&comment("Round $i");
&D_ENCRYPT($i,$L,$R,$i*2,$ks,"des_SPtrans","eax","ebx","ecx","edx");
&comment("");
&comment("Round ".sprintf("%d",$i+1));
&D_ENCRYPT($i+1,$R,$L,($i+1)*2,$ks,"des_SPtrans","eax","ebx","ecx","edx");
}
&jmp(&label("end"));
&set_label("start_decrypt");
for ($i=15; $i>0; $i-=2)
{
&comment("");
&comment("Round $i");
&D_ENCRYPT(15-$i,$L,$R,$i*2,$ks,"des_SPtrans","eax","ebx","ecx","edx");
&comment("");
&comment("Round ".sprintf("%d",$i-1));
&D_ENCRYPT(15-$i+1,$R,$L,($i-1)*2,$ks,"des_SPtrans","eax","ebx","ecx","edx");
}
&set_label("end");
if ($do_ip)
{
&comment("");
&comment("FP");
&mov("edx",&wparam(0));
&FP_new($L,$R,"eax",3);
&mov(&DWP(0,"edx","",0),"eax");
&mov(&DWP(4,"edx","",0),$R);
}
else
{
&comment("");
&comment("Fixup");
&rotr($L,3); # r
&mov("eax",&wparam(0));
&rotr($R,3); # l
&mov(&DWP(0,"eax","",0),$L);
&mov(&DWP(4,"eax","",0),$R);
}
&pop("ebp");
&pop("ebx");
&pop("edi");
&pop("esi");
&ret();
&function_end_B($name);
}
sub D_ENCRYPT
{
local($r,$L,$R,$S,$ks,$desSP,$u,$tmp1,$tmp2,$t)=@_;
&mov( $u, &DWP(&n2a($S*4),$ks,"",0));
&xor( $tmp1, $tmp1);
&mov( $t, &DWP(&n2a(($S+1)*4),$ks,"",0));
&xor( $u, $R);
&xor( $t, $R);
&and( $u, "0xfcfcfcfc" );
&and( $t, "0xcfcfcfcf" );
&movb( &LB($tmp1), &LB($u) );
&movb( &LB($tmp2), &HB($u) );
&rotr( $t, 4 );
&mov( $ks, &DWP(" $desSP",$tmp1,"",0));
&movb( &LB($tmp1), &LB($t) );
&xor( $L, $ks);
&mov( $ks, &DWP("0x200+$desSP",$tmp2,"",0));
&xor( $L, $ks); ######
&movb( &LB($tmp2), &HB($t) );
&shr( $u, 16);
&mov( $ks, &DWP("0x100+$desSP",$tmp1,"",0));
&xor( $L, $ks); ######
&movb( &LB($tmp1), &HB($u) );
&shr( $t, 16);
&mov( $ks, &DWP("0x300+$desSP",$tmp2,"",0));
&xor( $L, $ks);
&mov( $ks, &wparam(1) );
&movb( &LB($tmp2), &HB($t) );
&and( $u, "0xff" );
&and( $t, "0xff" );
&mov( $tmp1, &DWP("0x600+$desSP",$tmp1,"",0));
&xor( $L, $tmp1);
&mov( $tmp1, &DWP("0x700+$desSP",$tmp2,"",0));
&xor( $L, $tmp1);
&mov( $tmp1, &DWP("0x400+$desSP",$u,"",0));
&xor( $L, $tmp1);
&mov( $tmp1, &DWP("0x500+$desSP",$t,"",0));
&xor( $L, $tmp1);
}
sub n2a
{
sprintf("%d",$_[0]);
}
# now has a side affect of rotating $a by $shift
sub R_PERM_OP
{
local($a,$b,$tt,$shift,$mask,$last)=@_;
&rotl( $a, $shift ) if ($shift != 0);
&mov( $tt, $a );
&xor( $a, $b );
&and( $a, $mask );
if (!$last eq $b)
{
&xor( $b, $a );
&xor( $tt, $a );
}
else
{
&xor( $tt, $a );
&xor( $b, $a );
}
&comment("");
}
sub IP_new
{
local($l,$r,$tt,$lr)=@_;
&R_PERM_OP($l,$r,$tt, 4,"0xf0f0f0f0",$l);
&R_PERM_OP($r,$tt,$l,20,"0xfff0000f",$l);
&R_PERM_OP($l,$tt,$r,14,"0x33333333",$r);
&R_PERM_OP($tt,$r,$l,22,"0x03fc03fc",$r);
&R_PERM_OP($l,$r,$tt, 9,"0xaaaaaaaa",$r);
if ($lr != 3)
{
if (($lr-3) < 0)
{ &rotr($tt, 3-$lr); }
else { &rotl($tt, $lr-3); }
}
if ($lr != 2)
{
if (($lr-2) < 0)
{ &rotr($r, 2-$lr); }
else { &rotl($r, $lr-2); }
}
}
sub FP_new
{
local($l,$r,$tt,$lr)=@_;
if ($lr != 2)
{
if (($lr-2) < 0)
{ &rotl($r, 2-$lr); }
else { &rotr($r, $lr-2); }
}
if ($lr != 3)
{
if (($lr-3) < 0)
{ &rotl($l, 3-$lr); }
else { &rotr($l, $lr-3); }
}
&R_PERM_OP($l,$r,$tt, 0,"0xaaaaaaaa",$r);
&R_PERM_OP($tt,$r,$l,23,"0x03fc03fc",$r);
&R_PERM_OP($l,$r,$tt,10,"0x33333333",$l);
&R_PERM_OP($r,$tt,$l,18,"0xfff0000f",$l);
&R_PERM_OP($l,$tt,$r,12,"0xf0f0f0f0",$r);
&rotr($tt , 4);
}
linux/crypto/ciphers/des/asm/des686.pl
+230
View File
@@ -0,0 +1,230 @@
#!/usr/bin/perl
$prog="des686.pl";
# base code is in microsft
# op dest, source
# format.
#
# WILL NOT WORK ANYMORE WITH desboth.pl
require "desboth.pl";
if ( ($ARGV[0] eq "elf"))
{ require "x86unix.pl"; }
elsif ( ($ARGV[0] eq "a.out"))
{ $aout=1; require "x86unix.pl"; }
elsif ( ($ARGV[0] eq "sol"))
{ $sol=1; require "x86unix.pl"; }
elsif ( ($ARGV[0] eq "cpp"))
{ $cpp=1; require "x86unix.pl"; }
elsif ( ($ARGV[0] eq "win32"))
{ require "x86ms.pl"; }
else
{
print STDERR <<"EOF";
Pick one target type from
elf - linux, FreeBSD etc
a.out - old linux
sol - x86 solaris
cpp - format so x86unix.cpp can be used
win32 - Windows 95/Windows NT
EOF
exit(1);
}
&comment("Don't even think of reading this code");
&comment("It was automatically generated by $prog");
&comment("Which is a perl program used to generate the x86 assember for");
&comment("any of elf, a.out, Win32, or Solaris");
&comment("It can be found in SSLeay 0.6.5+ or in libdes 3.26+");
&comment("eric <eay\@cryptsoft.com>");
&comment("");
&file("dx86xxxx");
$L="edi";
$R="esi";
&des_encrypt("des_encrypt",1);
&des_encrypt("des_encrypt2",0);
&des_encrypt3("des_encrypt3",1);
&des_encrypt3("des_decrypt3",0);
&file_end();
sub des_encrypt
{
local($name,$do_ip)=@_;
&function_begin($name,"EXTRN _des_SPtrans:DWORD");
&comment("");
&comment("Load the 2 words");
&mov("eax",&wparam(0));
&mov($L,&DWP(0,"eax","",0));
&mov($R,&DWP(4,"eax","",0));
$ksp=&wparam(1);
if ($do_ip)
{
&comment("");
&comment("IP");
&IP_new($L,$R,"eax");
}
&comment("");
&comment("fixup rotate");
&rotl($R,3);
&rotl($L,3);
&exch($L,$R);
&comment("");
&comment("load counter, key_schedule and enc flag");
&mov("eax",&wparam(2)); # get encrypt flag
&mov("ebp",&wparam(1)); # get ks
&cmp("eax","0");
&je(&label("start_decrypt"));
# encrypting part
for ($i=0; $i<16; $i+=2)
{
&comment("");
&comment("Round $i");
&D_ENCRYPT($L,$R,$i*2,"ebp","des_SPtrans","ecx","edx","eax","ebx");
&comment("");
&comment("Round ".sprintf("%d",$i+1));
&D_ENCRYPT($R,$L,($i+1)*2,"ebp","des_SPtrans","ecx","edx","eax","ebx");
}
&jmp(&label("end"));
&set_label("start_decrypt");
for ($i=15; $i>0; $i-=2)
{
&comment("");
&comment("Round $i");
&D_ENCRYPT($L,$R,$i*2,"ebp","des_SPtrans","ecx","edx","eax","ebx");
&comment("");
&comment("Round ".sprintf("%d",$i-1));
&D_ENCRYPT($R,$L,($i-1)*2,"ebp","des_SPtrans","ecx","edx","eax","ebx");
}
&set_label("end");
&comment("");
&comment("Fixup");
&rotr($L,3); # r
&rotr($R,3); # l
if ($do_ip)
{
&comment("");
&comment("FP");
&FP_new($R,$L,"eax");
}
&mov("eax",&wparam(0));
&mov(&DWP(0,"eax","",0),$L);
&mov(&DWP(4,"eax","",0),$R);
&function_end($name);
}
# The logic is to load R into 2 registers and operate on both at the same time.
# We also load the 2 R's into 2 more registers so we can do the 'move word down a byte'
# while also masking the other copy and doing a lookup. We then also accumulate the
# L value in 2 registers then combine them at the end.
sub D_ENCRYPT
{
local($L,$R,$S,$ks,$desSP,$u,$t,$tmp1,$tmp2,$tmp3)=@_;
&mov( $u, &DWP(&n2a($S*4),$ks,"",0));
&mov( $t, &DWP(&n2a(($S+1)*4),$ks,"",0));
&xor( $u, $R );
&xor( $t, $R );
&rotr( $t, 4 );
# the numbers at the end of the line are origional instruction order
&mov( $tmp2, $u ); # 1 2
&mov( $tmp1, $t ); # 1 1
&and( $tmp2, "0xfc" ); # 1 4
&and( $tmp1, "0xfc" ); # 1 3
&shr( $t, 8 ); # 1 5
&xor( $L, &DWP("0x100+$desSP",$tmp1,"",0)); # 1 7
&shr( $u, 8 ); # 1 6
&mov( $tmp1, &DWP(" $desSP",$tmp2,"",0)); # 1 8
&mov( $tmp2, $u ); # 2 2
&xor( $L, $tmp1 ); # 1 9
&and( $tmp2, "0xfc" ); # 2 4
&mov( $tmp1, $t ); # 2 1
&and( $tmp1, "0xfc" ); # 2 3
&shr( $t, 8 ); # 2 5
&xor( $L, &DWP("0x300+$desSP",$tmp1,"",0)); # 2 7
&shr( $u, 8 ); # 2 6
&mov( $tmp1, &DWP("0x200+$desSP",$tmp2,"",0)); # 2 8
&mov( $tmp2, $u ); # 3 2
&xor( $L, $tmp1 ); # 2 9
&and( $tmp2, "0xfc" ); # 3 4
&mov( $tmp1, $t ); # 3 1
&shr( $u, 8 ); # 3 6
&and( $tmp1, "0xfc" ); # 3 3
&shr( $t, 8 ); # 3 5
&xor( $L, &DWP("0x500+$desSP",$tmp1,"",0)); # 3 7
&mov( $tmp1, &DWP("0x400+$desSP",$tmp2,"",0)); # 3 8
&and( $t, "0xfc" ); # 4 1
&xor( $L, $tmp1 ); # 3 9
&and( $u, "0xfc" ); # 4 2
&xor( $L, &DWP("0x700+$desSP",$t,"",0)); # 4 3
&xor( $L, &DWP("0x600+$desSP",$u,"",0)); # 4 4
}
sub PERM_OP
{
local($a,$b,$tt,$shift,$mask)=@_;
&mov( $tt, $a );
&shr( $tt, $shift );
&xor( $tt, $b );
&and( $tt, $mask );
&xor( $b, $tt );
&shl( $tt, $shift );
&xor( $a, $tt );
}
sub IP_new
{
local($l,$r,$tt)=@_;
&PERM_OP($r,$l,$tt, 4,"0x0f0f0f0f");
&PERM_OP($l,$r,$tt,16,"0x0000ffff");
&PERM_OP($r,$l,$tt, 2,"0x33333333");
&PERM_OP($l,$r,$tt, 8,"0x00ff00ff");
&PERM_OP($r,$l,$tt, 1,"0x55555555");
}
sub FP_new
{
local($l,$r,$tt)=@_;
&PERM_OP($l,$r,$tt, 1,"0x55555555");
&PERM_OP($r,$l,$tt, 8,"0x00ff00ff");
&PERM_OP($l,$r,$tt, 2,"0x33333333");
&PERM_OP($r,$l,$tt,16,"0x0000ffff");
&PERM_OP($l,$r,$tt, 4,"0x0f0f0f0f");
}
sub n2a
{
sprintf("%d",$_[0]);
}
linux/crypto/ciphers/des/asm/desboth.pl
+79
View File
@@ -0,0 +1,79 @@
#!/usr/bin/perl
$L="edi";
$R="esi";
sub des_encrypt3
{
local($name,$enc)=@_;
&function_begin_B($name,"");
&push("ebx");
&mov("ebx",&wparam(0));
&push("ebp");
&push("esi");
&push("edi");
&comment("");
&comment("Load the data words");
&mov($L,&DWP(0,"ebx","",0));
&mov($R,&DWP(4,"ebx","",0));
&stack_push(3);
&comment("");
&comment("IP");
&IP_new($L,$R,"edx",0);
# put them back
if ($enc)
{
&mov(&DWP(4,"ebx","",0),$R);
&mov("eax",&wparam(1));
&mov(&DWP(0,"ebx","",0),"edx");
&mov("edi",&wparam(2));
&mov("esi",&wparam(3));
}
else
{
&mov(&DWP(4,"ebx","",0),$R);
&mov("esi",&wparam(1));
&mov(&DWP(0,"ebx","",0),"edx");
&mov("edi",&wparam(2));
&mov("eax",&wparam(3));
}
&mov(&swtmp(2), (($enc)?"1":"0"));
&mov(&swtmp(1), "eax");
&mov(&swtmp(0), "ebx");
&call("des_encrypt2");
&mov(&swtmp(2), (($enc)?"0":"1"));
&mov(&swtmp(1), "edi");
&mov(&swtmp(0), "ebx");
&call("des_encrypt2");
&mov(&swtmp(2), (($enc)?"1":"0"));
&mov(&swtmp(1), "esi");
&mov(&swtmp(0), "ebx");
&call("des_encrypt2");
&stack_pop(3);
&mov($L,&DWP(0,"ebx","",0));
&mov($R,&DWP(4,"ebx","",0));
&comment("");
&comment("FP");
&FP_new($L,$R,"eax",0);
&mov(&DWP(0,"ebx","",0),"eax");
&mov(&DWP(4,"ebx","",0),$R);
&pop("edi");
&pop("esi");
&pop("ebp");
&pop("ebx");
&ret();
&function_end_B($name);
}
linux/crypto/ciphers/des/asm/perlasm/cbc.pl
+342
View File
@@ -0,0 +1,342 @@
#!/usr/bin/perl
# void des_ncbc_encrypt(input, output, length, schedule, ivec, enc)
# des_cblock (*input);
# des_cblock (*output);
# long length;
# des_key_schedule schedule;
# des_cblock (*ivec);
# int enc;
#
# calls
# des_encrypt((DES_LONG *)tin,schedule,DES_ENCRYPT);
#
#&cbc("des_ncbc_encrypt","des_encrypt",0);
#&cbc("BF_cbc_encrypt","BF_encrypt","BF_encrypt",
# 1,4,5,3,5,-1);
#&cbc("des_ncbc_encrypt","des_encrypt","des_encrypt",
# 0,4,5,3,5,-1);
#&cbc("des_ede3_cbc_encrypt","des_encrypt3","des_decrypt3",
# 0,6,7,3,4,5);
#
# When doing a cipher that needs bigendian order,
# for encrypt, the iv is kept in bigendian form,
# while for decrypt, it is kept in little endian.
sub cbc
{
local($name,$enc_func,$dec_func,$swap,$iv_off,$enc_off,$p1,$p2,$p3)=@_;
# name is the function name
# enc_func and dec_func and the functions to call for encrypt/decrypt
# swap is true if byte order needs to be reversed
# iv_off is parameter number for the iv
# enc_off is parameter number for the encrypt/decrypt flag
# p1,p2,p3 are the offsets for parameters to be passed to the
# underlying calls.
&function_begin_B($name,"");
&comment("");
$in="esi";
$out="edi";
$count="ebp";
&push("ebp");
&push("ebx");
&push("esi");
&push("edi");
$data_off=4;
$data_off+=4 if ($p1 > 0);
$data_off+=4 if ($p2 > 0);
$data_off+=4 if ($p3 > 0);
&mov($count, &wparam(2)); # length
&comment("getting iv ptr from parameter $iv_off");
&mov("ebx", &wparam($iv_off)); # Get iv ptr
&mov($in, &DWP(0,"ebx","",0));# iv[0]
&mov($out, &DWP(4,"ebx","",0));# iv[1]
&push($out);
&push($in);
&push($out); # used in decrypt for iv[1]
&push($in); # used in decrypt for iv[0]
&mov("ebx", "esp"); # This is the address of tin[2]
&mov($in, &wparam(0)); # in
&mov($out, &wparam(1)); # out
# We have loaded them all, how lets push things
&comment("getting encrypt flag from parameter $enc_off");
&mov("ecx", &wparam($enc_off)); # Get enc flag
if ($p3 > 0)
{
&comment("get and push parameter $p3");
if ($enc_off != $p3)
{ &mov("eax", &wparam($p3)); &push("eax"); }
else { &push("ecx"); }
}
if ($p2 > 0)
{
&comment("get and push parameter $p2");
if ($enc_off != $p2)
{ &mov("eax", &wparam($p2)); &push("eax"); }
else { &push("ecx"); }
}
if ($p1 > 0)
{
&comment("get and push parameter $p1");
if ($enc_off != $p1)
{ &mov("eax", &wparam($p1)); &push("eax"); }
else { &push("ecx"); }
}
&push("ebx"); # push data/iv
&cmp("ecx",0);
&jz(&label("decrypt"));
&and($count,0xfffffff8);
&mov("eax", &DWP($data_off,"esp","",0)); # load iv[0]
&mov("ebx", &DWP($data_off+4,"esp","",0)); # load iv[1]
&jz(&label("encrypt_finish"));
#############################################################
&set_label("encrypt_loop");
# encrypt start
# "eax" and "ebx" hold iv (or the last cipher text)
&mov("ecx", &DWP(0,$in,"",0)); # load first 4 bytes
&mov("edx", &DWP(4,$in,"",0)); # second 4 bytes
&xor("eax", "ecx");
&xor("ebx", "edx");
&bswap("eax") if $swap;
&bswap("ebx") if $swap;
&mov(&DWP($data_off,"esp","",0), "eax"); # put in array for call
&mov(&DWP($data_off+4,"esp","",0), "ebx"); #
&call($enc_func);
&mov("eax", &DWP($data_off,"esp","",0));
&mov("ebx", &DWP($data_off+4,"esp","",0));
&bswap("eax") if $swap;
&bswap("ebx") if $swap;
&mov(&DWP(0,$out,"",0),"eax");
&mov(&DWP(4,$out,"",0),"ebx");
# eax and ebx are the next iv.
&add($in, 8);
&add($out, 8);
&sub($count, 8);
&jnz(&label("encrypt_loop"));
###################################################################3
&set_label("encrypt_finish");
&mov($count, &wparam(2)); # length
&and($count, 7);
&jz(&label("finish"));
&xor("ecx","ecx");
&xor("edx","edx");
&mov($count,&DWP(&label("cbc_enc_jmp_table"),"",$count,4));
&jmp_ptr($count);
&set_label("ej7");
&xor("edx", "edx") if $ppro; # ppro friendly
&movb(&HB("edx"), &BP(6,$in,"",0));
&shl("edx",8);
&set_label("ej6");
&movb(&HB("edx"), &BP(5,$in,"",0));
&set_label("ej5");
&movb(&LB("edx"), &BP(4,$in,"",0));
&set_label("ej4");
&mov("ecx", &DWP(0,$in,"",0));
&jmp(&label("ejend"));
&set_label("ej3");
&movb(&HB("ecx"), &BP(2,$in,"",0));
&xor("ecx", "ecx") if $ppro; # ppro friendly
&shl("ecx",8);
&set_label("ej2");
&movb(&HB("ecx"), &BP(1,$in,"",0));
&set_label("ej1");
&movb(&LB("ecx"), &BP(0,$in,"",0));
&set_label("ejend");
&xor("eax", "ecx");
&xor("ebx", "edx");
&bswap("eax") if $swap;
&bswap("ebx") if $swap;
&mov(&DWP($data_off,"esp","",0), "eax"); # put in array for call
&mov(&DWP($data_off+4,"esp","",0), "ebx"); #
&call($enc_func);
&mov("eax", &DWP($data_off,"esp","",0));
&mov("ebx", &DWP($data_off+4,"esp","",0));
&bswap("eax") if $swap;
&bswap("ebx") if $swap;
&mov(&DWP(0,$out,"",0),"eax");
&mov(&DWP(4,$out,"",0),"ebx");
&jmp(&label("finish"));
#############################################################
#############################################################
&set_label("decrypt",1);
# decrypt start
&and($count,0xfffffff8);
# The next 2 instructions are only for if the jz is taken
&mov("eax", &DWP($data_off+8,"esp","",0)); # get iv[0]
&mov("ebx", &DWP($data_off+12,"esp","",0)); # get iv[1]
&jz(&label("decrypt_finish"));
&set_label("decrypt_loop");
&mov("eax", &DWP(0,$in,"",0)); # load first 4 bytes
&mov("ebx", &DWP(4,$in,"",0)); # second 4 bytes
&bswap("eax") if $swap;
&bswap("ebx") if $swap;
&mov(&DWP($data_off,"esp","",0), "eax"); # put back
&mov(&DWP($data_off+4,"esp","",0), "ebx"); #
&call($dec_func);
&mov("eax", &DWP($data_off,"esp","",0)); # get return
&mov("ebx", &DWP($data_off+4,"esp","",0)); #
&bswap("eax") if $swap;
&bswap("ebx") if $swap;
&mov("ecx", &DWP($data_off+8,"esp","",0)); # get iv[0]
&mov("edx", &DWP($data_off+12,"esp","",0)); # get iv[1]
&xor("ecx", "eax");
&xor("edx", "ebx");
&mov("eax", &DWP(0,$in,"",0)); # get old cipher text,
&mov("ebx", &DWP(4,$in,"",0)); # next iv actually
&mov(&DWP(0,$out,"",0),"ecx");
&mov(&DWP(4,$out,"",0),"edx");
&mov(&DWP($data_off+8,"esp","",0), "eax"); # save iv
&mov(&DWP($data_off+12,"esp","",0), "ebx"); #
&add($in, 8);
&add($out, 8);
&sub($count, 8);
&jnz(&label("decrypt_loop"));
############################ ENDIT #######################3
&set_label("decrypt_finish");
&mov($count, &wparam(2)); # length
&and($count, 7);
&jz(&label("finish"));
&mov("eax", &DWP(0,$in,"",0)); # load first 4 bytes
&mov("ebx", &DWP(4,$in,"",0)); # second 4 bytes
&bswap("eax") if $swap;
&bswap("ebx") if $swap;
&mov(&DWP($data_off,"esp","",0), "eax"); # put back
&mov(&DWP($data_off+4,"esp","",0), "ebx"); #
&call($dec_func);
&mov("eax", &DWP($data_off,"esp","",0)); # get return
&mov("ebx", &DWP($data_off+4,"esp","",0)); #
&bswap("eax") if $swap;
&bswap("ebx") if $swap;
&mov("ecx", &DWP($data_off+8,"esp","",0)); # get iv[0]
&mov("edx", &DWP($data_off+12,"esp","",0)); # get iv[1]
&xor("ecx", "eax");
&xor("edx", "ebx");
# this is for when we exit
&mov("eax", &DWP(0,$in,"",0)); # get old cipher text,
&mov("ebx", &DWP(4,$in,"",0)); # next iv actually
&set_label("dj7");
&rotr("edx", 16);
&movb(&BP(6,$out,"",0), &LB("edx"));
&shr("edx",16);
&set_label("dj6");
&movb(&BP(5,$out,"",0), &HB("edx"));
&set_label("dj5");
&movb(&BP(4,$out,"",0), &LB("edx"));
&set_label("dj4");
&mov(&DWP(0,$out,"",0), "ecx");
&jmp(&label("djend"));
&set_label("dj3");
&rotr("ecx", 16);
&movb(&BP(2,$out,"",0), &LB("ecx"));
&shl("ecx",16);
&set_label("dj2");
&movb(&BP(1,$in,"",0), &HB("ecx"));
&set_label("dj1");
&movb(&BP(0,$in,"",0), &LB("ecx"));
&set_label("djend");
# final iv is still in eax:ebx
&jmp(&label("finish"));
############################ FINISH #######################3
&set_label("finish",1);
&mov("ecx", &wparam($iv_off)); # Get iv ptr
#################################################
$total=16+4;
$total+=4 if ($p1 > 0);
$total+=4 if ($p2 > 0);
$total+=4 if ($p3 > 0);
&add("esp",$total);
&mov(&DWP(0,"ecx","",0), "eax"); # save iv
&mov(&DWP(4,"ecx","",0), "ebx"); # save iv
&function_end_A($name);
&set_label("cbc_enc_jmp_table",1);
&data_word("0");
&data_word(&label("ej1"));
&data_word(&label("ej2"));
&data_word(&label("ej3"));
&data_word(&label("ej4"));
&data_word(&label("ej5"));
&data_word(&label("ej6"));
&data_word(&label("ej7"));
&set_label("cbc_dec_jmp_table",1);
&data_word("0");
&data_word(&label("dj1"));
&data_word(&label("dj2"));
&data_word(&label("dj3"));
&data_word(&label("dj4"));
&data_word(&label("dj5"));
&data_word(&label("dj6"));
&data_word(&label("dj7"));
&function_end_B($name);
}
1;
linux/crypto/ciphers/des/asm/perlasm/readme
+124
View File
@@ -0,0 +1,124 @@
The perl scripts in this directory are my 'hack' to generate
multiple different assembler formats via the one origional script.
The way to use this library is to start with adding the path to this directory
and then include it.
push(@INC,"perlasm","../../perlasm");
require "x86asm.pl";
The first thing we do is setup the file and type of assember
&asm_init($ARGV[0],$0);
The first argument is the 'type'. Currently
'cpp', 'sol', 'a.out', 'elf' or 'win32'.
Argument 2 is the file name.
The reciprocal function is
&asm_finish() which should be called at the end.
There are 2 main 'packages'. x86ms.pl, which is the microsoft assembler,
and x86unix.pl which is the unix (gas) version.
Functions of interest are:
&external_label("des_SPtrans"); declare and external variable
&LB(reg); Low byte for a register
&HB(reg); High byte for a register
&BP(off,base,index,scale) Byte pointer addressing
&DWP(off,base,index,scale) Word pointer addressing
&stack_push(num) Basically a 'sub esp, num*4' with extra
&stack_pop(num) inverse of stack_push
&function_begin(name,extra) Start a function with pushing of
edi, esi, ebx and ebp. extra is extra win32
external info that may be required.
&function_begin_B(name,extra) Same as norma function_begin but no pushing.
&function_end(name) Call at end of function.
&function_end_A(name) Standard pop and ret, for use inside functions
&function_end_B(name) Call at end but with poping or 'ret'.
&swtmp(num) Address on stack temp word.
&wparam(num) Parameter number num, that was push
in C convention. This all works over pushes
and pops.
&comment("hello there") Put in a comment.
&label("loop") Refer to a label, normally a jmp target.
&set_label("loop") Set a label at this point.
&data_word(word) Put in a word of data.
So how does this all hold together? Given
int calc(int len, int *data)
{
int i,j=0;
for (i=0; i<len; i++)
{
j+=other(data[i]);
}
}
So a very simple version of this function could be coded as
push(@INC,"perlasm","../../perlasm");
require "x86asm.pl";
&asm_init($ARGV[0],"cacl.pl");
&external_label("other");
$tmp1= "eax";
$j= "edi";
$data= "esi";
$i= "ebp";
&comment("a simple function");
&function_begin("calc");
&mov( $data, &wparam(1)); # data
&xor( $j, $j);
&xor( $i, $i);
&set_label("loop");
&cmp( $i, &wparam(0));
&jge( &label("end"));
&mov( $tmp1, &DWP(0,$data,$i,4));
&push( $tmp1);
&call( "other");
&add( $j, "eax");
&pop( $tmp1);
&inc( $i);
&jmp( &label("loop"));
&set_label("end");
&mov( "eax", $j);
&function_end("calc");
&asm_finish();
The above example is very very unoptimised but gives an idea of how
things work.
There is also a cbc mode function generator in cbc.pl
&cbc( $name,
$encrypt_function_name,
$decrypt_function_name,
$true_if_byte_swap_needed,
$parameter_number_for_iv,
$parameter_number_for_encrypt_flag,
$first_parameter_to_pass,
$second_parameter_to_pass,
$third_parameter_to_pass);
So for example, given
void BF_encrypt(BF_LONG *data,BF_KEY *key);
void BF_decrypt(BF_LONG *data,BF_KEY *key);
void BF_cbc_encrypt(unsigned char *in, unsigned char *out, long length,
BF_KEY *ks, unsigned char *iv, int enc);
&cbc("BF_cbc_encrypt","BF_encrypt","BF_encrypt",1,4,5,3,-1,-1);
&cbc("des_ncbc_encrypt","des_encrypt","des_encrypt",0,4,5,3,5,-1);
&cbc("des_ede3_cbc_encrypt","des_encrypt3","des_decrypt3",0,6,7,3,4,5);
linux/crypto/ciphers/des/asm/perlasm/x86asm.pl
+111
View File
@@ -0,0 +1,111 @@
#!/usr/bin/perl
# require 'x86asm.pl';
# &asm_init("cpp","des-586.pl");
# XXX
# XXX
# main'asm_finish
sub main'asm_finish
{
&file_end();
&asm_finish_cpp() if $cpp;
print &asm_get_output();
}
sub main'asm_init
{
($type,$fn)=@_;
$filename=$fn;
$cpp=$sol=$aout=$win32=0;
if ( ($type eq "elf"))
{ require "x86unix.pl"; }
elsif ( ($type eq "a.out"))
{ $aout=1; require "x86unix.pl"; }
elsif ( ($type eq "sol"))
{ $sol=1; require "x86unix.pl"; }
elsif ( ($type eq "cpp"))
{ $cpp=1; require "x86unix.pl"; }
elsif ( ($type eq "win32"))
{ $win32=1; require "x86ms.pl"; }
else
{
print STDERR <<"EOF";
Pick one target type from
elf - linux, FreeBSD etc
a.out - old linux
sol - x86 solaris
cpp - format so x86unix.cpp can be used
win32 - Windows 95/Windows NT
EOF
exit(1);
}
&asm_init_output();
&comment("Don't even think of reading this code");
&comment("It was automatically generated by $filename");
&comment("Which is a perl program used to generate the x86 assember for");
&comment("any of elf, a.out, BSDI,Win32, or Solaris");
&comment("eric <eay\@cryptsoft.com>");
&comment("");
$filename =~ s/\.pl$//;
&file($filename);
}
sub asm_finish_cpp
{
return unless $cpp;
local($tmp,$i);
foreach $i (&get_labels())
{
$tmp.="#define $i _$i\n";
}
print <<"EOF";
/* Run the C pre-processor over this file with one of the following defined
* ELF - elf object files,
* OUT - a.out object files,
* BSDI - BSDI style a.out object files
* SOL - Solaris style elf
*/
#define TYPE(a,b) .type a,b
#define SIZE(a,b) .size a,b
#if defined(OUT) || defined(BSDI)
$tmp
#endif
#ifdef OUT
#define OK 1
#define ALIGN 4
#endif
#ifdef BSDI
#define OK 1
#define ALIGN 4
#undef SIZE
#undef TYPE
#endif
#if defined(ELF) || defined(SOL)
#define OK 1
#define ALIGN 16
#endif
#ifndef OK
You need to define one of
ELF - elf systems - linux-elf, NetBSD and DG-UX
OUT - a.out systems - linux-a.out and FreeBSD
SOL - solaris systems, which are elf with strange comment lines
BSDI - a.out with a very primative version of as.
#endif
/* Let the Assembler begin :-) */
EOF
}
1;
linux/crypto/ciphers/des/asm/perlasm/x86ms.pl
+345
View File
@@ -0,0 +1,345 @@
#!/usr/bin/perl
package x86ms;
$label="L000";
%lb=( 'eax', 'al',
'ebx', 'bl',
'ecx', 'cl',
'edx', 'dl',
'ax', 'al',
'bx', 'bl',
'cx', 'cl',
'dx', 'dl',
);
%hb=( 'eax', 'ah',
'ebx', 'bh',
'ecx', 'ch',
'edx', 'dh',
'ax', 'ah',
'bx', 'bh',
'cx', 'ch',
'dx', 'dh',
);
sub main'asm_init_output { @out=(); }
sub main'asm_get_output { return(@out); }
sub main'get_labels { return(@labels); }
sub main'external_label { push(@labels,@_); }
sub main'LB
{
(defined($lb{$_[0]})) || die "$_[0] does not have a 'low byte'\n";
return($lb{$_[0]});
}
sub main'HB
{
(defined($hb{$_[0]})) || die "$_[0] does not have a 'high byte'\n";
return($hb{$_[0]});
}
sub main'BP
{
&get_mem("BYTE",@_);
}
sub main'DWP
{
&get_mem("DWORD",@_);
}
sub main'stack_push
{
local($num)=@_;
$stack+=$num*4;
&main'sub("esp",$num*4);
}
sub main'stack_pop
{
local($num)=@_;
$stack-=$num*4;
&main'add("esp",$num*4);
}
sub get_mem
{
local($size,$addr,$reg1,$reg2,$idx)=@_;
local($t,$post);
local($ret)="$size PTR ";
$addr =~ s/^\s+//;
if ($addr =~ /^(.+)\+(.+)$/)
{
$reg2=&conv($1);
$addr="_$2";
}
elsif ($addr =~ /^[_a-zA-Z]/)
{
$addr="_$addr";
}
$reg1="$regs{$reg1}" if defined($regs{$reg1});
$reg2="$regs{$reg2}" if defined($regs{$reg2});
if (($addr ne "") && ($addr ne 0))
{
if ($addr !~ /^-/)
{ $ret.=$addr; }
else { $post=$addr; }
}
if ($reg2 ne "")
{
$t="";
$t="*$idx" if ($idx != 0);
$reg1="+".$reg1 if ("$reg1$post" ne "");
$ret.="[$reg2$t$reg1$post]";
}
else
{
$ret.="[$reg1$post]"
}
return($ret);
}
sub main'mov { &out2("mov",@_); }
sub main'movb { &out2("mov",@_); }
sub main'and { &out2("and",@_); }
sub main'or { &out2("or",@_); }
sub main'shl { &out2("shl",@_); }
sub main'shr { &out2("shr",@_); }
sub main'xor { &out2("xor",@_); }
sub main'xorb { &out2("xor",@_); }
sub main'add { &out2("add",@_); }
sub main'adc { &out2("adc",@_); }
sub main'sub { &out2("sub",@_); }
sub main'rotl { &out2("rol",@_); }
sub main'rotr { &out2("ror",@_); }
sub main'exch { &out2("xchg",@_); }
sub main'cmp { &out2("cmp",@_); }
sub main'lea { &out2("lea",@_); }
sub main'mul { &out1("mul",@_); }
sub main'div { &out1("div",@_); }
sub main'dec { &out1("dec",@_); }
sub main'inc { &out1("inc",@_); }
sub main'jmp { &out1("jmp",@_); }
sub main'jmp_ptr { &out1p("jmp",@_); }
sub main'je { &out1("je",@_); }
sub main'jle { &out1("jle",@_); }
sub main'jz { &out1("jz",@_); }
sub main'jge { &out1("jge",@_); }
sub main'jl { &out1("jl",@_); }
sub main'jb { &out1("jb",@_); }
sub main'jnz { &out1("jnz",@_); }
sub main'jne { &out1("jne",@_); }
sub main'push { &out1("push",@_); $stack+=4; }
sub main'pop { &out1("pop",@_); $stack-=4; }
sub main'bswap { &out1("bswap",@_); &using486(); }
sub main'not { &out1("not",@_); }
sub main'call { &out1("call",'_'.$_[0]); }
sub main'ret { &out0("ret"); }
sub main'nop { &out0("nop"); }
sub out2
{
local($name,$p1,$p2)=@_;
local($l,$t);
push(@out,"\t$name\t");
$t=&conv($p1).",";
$l=length($t);
push(@out,$t);
$l=4-($l+9)/8;
push(@out,"\t" x $l);
push(@out,&conv($p2));
push(@out,"\n");
}
sub out0
{
local($name)=@_;
push(@out,"\t$name\n");
}
sub out1
{
local($name,$p1)=@_;
local($l,$t);
push(@out,"\t$name\t".&conv($p1)."\n");
}
sub conv
{
local($p)=@_;
$p =~ s/0x([0-9A-Fa-f]+)/0$1h/;
return $p;
}
sub using486
{
return if $using486;
$using486++;
grep(s/\.386/\.486/,@out);
}
sub main'file
{
local($file)=@_;
local($tmp)=<<"EOF";
TITLE $file.asm
.386
.model FLAT
EOF
push(@out,$tmp);
}
sub main'function_begin
{
local($func,$extra)=@_;
push(@labels,$func);
local($tmp)=<<"EOF";
_TEXT SEGMENT
PUBLIC _$func
$extra
_$func PROC NEAR
push ebp
push ebx
push esi
push edi
EOF
push(@out,$tmp);
$stack=20;
}
sub main'function_begin_B
{
local($func,$extra)=@_;
local($tmp)=<<"EOF";
_TEXT SEGMENT
PUBLIC _$func
$extra
_$func PROC NEAR
EOF
push(@out,$tmp);
$stack=4;
}
sub main'function_end
{
local($func)=@_;
local($tmp)=<<"EOF";
pop edi
pop esi
pop ebx
pop ebp
ret
_$func ENDP
_TEXT ENDS
EOF
push(@out,$tmp);
$stack=0;
%label=();
}
sub main'function_end_B
{
local($func)=@_;
local($tmp)=<<"EOF";
_$func ENDP
_TEXT ENDS
EOF
push(@out,$tmp);
$stack=0;
%label=();
}
sub main'function_end_A
{
local($func)=@_;
local($tmp)=<<"EOF";
pop edi
pop esi
pop ebx
pop ebp
ret
EOF
push(@out,$tmp);
}
sub main'file_end
{
push(@out,"END\n");
}
sub main'wparam
{
local($num)=@_;
return(&main'DWP($stack+$num*4,"esp","",0));
}
sub main'swtmp
{
return(&main'DWP($_[0]*4,"esp","",0));
}
# Should use swtmp, which is above esp. Linix can trash the stack above esp
#sub main'wtmp
# {
# local($num)=@_;
#
# return(&main'DWP(-(($num+1)*4),"esp","",0));
# }
sub main'comment
{
foreach (@_)
{
push(@out,"\t; $_\n");
}
}
sub main'label
{
if (!defined($label{$_[0]}))
{
$label{$_[0]}="\$${label}${_[0]}";
$label++;
}
return($label{$_[0]});
}
sub main'set_label
{
if (!defined($label{$_[0]}))
{
$label{$_[0]}="${label}${_[0]}";
$label++;
}
push(@out,"$label{$_[0]}:\n");
}
sub main'data_word
{
push(@out,"\tDD\t$_[0]\n");
}
sub out1p
{
local($name,$p1)=@_;
local($l,$t);
push(@out,"\t$name\t ".&conv($p1)."\n");
}
linux/crypto/ciphers/des/asm/perlasm/x86unix.pl
+403
View File
@@ -0,0 +1,403 @@
#!/usr/bin/perl
package x86unix;
$label="L000";
$align=($main'aout)?"4":"16";
$under=($main'aout)?"_":"";
$com_start=($main'sol)?"/":"#";
sub main'asm_init_output { @out=(); }
sub main'asm_get_output { return(@out); }
sub main'get_labels { return(@labels); }
sub main'external_label { push(@labels,@_); }
if ($main'cpp)
{
$align="ALIGN";
$under="";
$com_start='/*';
$com_end='*/';
}
%lb=( 'eax', '%al',
'ebx', '%bl',
'ecx', '%cl',
'edx', '%dl',
'ax', '%al',
'bx', '%bl',
'cx', '%cl',
'dx', '%dl',
);
%hb=( 'eax', '%ah',
'ebx', '%bh',
'ecx', '%ch',
'edx', '%dh',
'ax', '%ah',
'bx', '%bh',
'cx', '%ch',
'dx', '%dh',
);
%regs=( 'eax', '%eax',
'ebx', '%ebx',
'ecx', '%ecx',
'edx', '%edx',
'esi', '%esi',
'edi', '%edi',
'ebp', '%ebp',
'esp', '%esp',
);
%reg_val=(
'eax', 0x00,
'ebx', 0x03,
'ecx', 0x01,
'edx', 0x02,
'esi', 0x06,
'edi', 0x07,
'ebp', 0x05,
'esp', 0x04,
);
sub main'LB
{
(defined($lb{$_[0]})) || die "$_[0] does not have a 'low byte'\n";
return($lb{$_[0]});
}
sub main'HB
{
(defined($hb{$_[0]})) || die "$_[0] does not have a 'high byte'\n";
return($hb{$_[0]});
}
sub main'DWP
{
local($addr,$reg1,$reg2,$idx)=@_;
$ret="";
$addr =~ s/(^|[+ \t])([A-Za-z_]+)($|[+ \t])/$1$under$2$3/;
$reg1="$regs{$reg1}" if defined($regs{$reg1});
$reg2="$regs{$reg2}" if defined($regs{$reg2});
$ret.=$addr if ($addr ne "") && ($addr ne 0);
if ($reg2 ne "")
{ $ret.="($reg1,$reg2,$idx)"; }
else
{ $ret.="($reg1)" }
return($ret);
}
sub main'BP
{
return(&main'DWP(@_));
}
#sub main'BP
# {
# local($addr,$reg1,$reg2,$idx)=@_;
#
# $ret="";
#
# $addr =~ s/(^|[+ \t])([A-Za-z_]+)($|[+ \t])/$1$under$2$3/;
# $reg1="$regs{$reg1}" if defined($regs{$reg1});
# $reg2="$regs{$reg2}" if defined($regs{$reg2});
# $ret.=$addr if ($addr ne "") && ($addr ne 0);
# if ($reg2 ne "")
# { $ret.="($reg1,$reg2,$idx)"; }
# else
# { $ret.="($reg1)" }
# return($ret);
# }
sub main'mov { &out2("movl",@_); }
sub main'movb { &out2("movb",@_); }
sub main'and { &out2("andl",@_); }
sub main'or { &out2("orl",@_); }
sub main'shl { &out2("sall",@_); }
sub main'shr { &out2("shrl",@_); }
sub main'xor { &out2("xorl",@_); }
sub main'xorb { &out2("xorb",@_); }
sub main'add { &out2("addl",@_); }
sub main'adc { &out2("adcl",@_); }
sub main'sub { &out2("subl",@_); }
sub main'rotl { &out2("roll",@_); }
sub main'rotr { &out2("rorl",@_); }
sub main'exch { &out2("xchg",@_); }
sub main'cmp { &out2("cmpl",@_); }
sub main'lea { &out2("leal",@_); }
sub main'mul { &out1("mull",@_); }
sub main'div { &out1("divl",@_); }
sub main'jmp { &out1("jmp",@_); }
sub main'jmp_ptr { &out1p("jmp",@_); }
sub main'je { &out1("je",@_); }
sub main'jle { &out1("jle",@_); }
sub main'jne { &out1("jne",@_); }
sub main'jnz { &out1("jnz",@_); }
sub main'jz { &out1("jz",@_); }
sub main'jge { &out1("jge",@_); }
sub main'jl { &out1("jl",@_); }
sub main'jb { &out1("jb",@_); }
sub main'dec { &out1("decl",@_); }
sub main'inc { &out1("incl",@_); }
sub main'push { &out1("pushl",@_); $stack+=4; }
sub main'pop { &out1("popl",@_); $stack-=4; }
sub main'bswap { &out1("bswapl",@_); }
sub main'not { &out1("notl",@_); }
sub main'call { &out1("call",$under.$_[0]); }
sub main'ret { &out0("ret"); }
sub main'nop { &out0("nop"); }
sub out2
{
local($name,$p1,$p2)=@_;
local($l,$ll,$t);
local(%special)=( "roll",0xD1C0,"rorl",0xD1C8,
"rcll",0xD1D0,"rcrl",0xD1D8,
"shll",0xD1E0,"shrl",0xD1E8,
"sarl",0xD1F8);
if ((defined($special{$name})) && defined($regs{$p1}) && ($p2 == 1))
{
$op=$special{$name}|$reg_val{$p1};
$tmp1=sprintf ".byte %d\n",($op>>8)&0xff;
$tmp2=sprintf ".byte %d\t",$op &0xff;
push(@out,$tmp1);
push(@out,$tmp2);
$p2=&conv($p2);
$p1=&conv($p1);
&main'comment("$name $p2 $p1");
return;
}
push(@out,"\t$name\t");
$t=&conv($p2).",";
$l=length($t);
push(@out,$t);
$ll=4-($l+9)/8;
$tmp1=sprintf "\t" x $ll;
push(@out,$tmp1);
push(@out,&conv($p1)."\n");
}
sub out1
{
local($name,$p1)=@_;
local($l,$t);
push(@out,"\t$name\t".&conv($p1)."\n");
}
sub out1p
{
local($name,$p1)=@_;
local($l,$t);
push(@out,"\t$name\t*".&conv($p1)."\n");
}
sub out0
{
push(@out,"\t$_[0]\n");
}
sub conv
{
local($p)=@_;
# $p =~ s/0x([0-9A-Fa-f]+)/0$1h/;
$p=$regs{$p} if (defined($regs{$p}));
$p =~ s/^(-{0,1}[0-9A-Fa-f]+)$/\$$1/;
$p =~ s/^(0x[0-9A-Fa-f]+)$/\$$1/;
return $p;
}
sub main'file
{
local($file)=@_;
local($tmp)=<<"EOF";
.file "$file.s"
.version "01.01"
gcc2_compiled.:
EOF
push(@out,$tmp);
}
sub main'function_begin
{
local($func)=@_;
$func=$under.$func;
local($tmp)=<<"EOF";
.text
.align $align
.globl $func
EOF
push(@out,$tmp);
if ($main'cpp)
{ $tmp=push(@out,"\tTYPE($func,\@function)\n"); }
else { $tmp=push(@out,"\t.type\t$func,\@function\n"); }
push(@out,"$func:\n");
$tmp=<<"EOF";
pushl %ebp
pushl %ebx
pushl %esi
pushl %edi
EOF
push(@out,$tmp);
$stack=20;
}
sub main'function_begin_B
{
local($func,$extra)=@_;
$func=$under.$func;
local($tmp)=<<"EOF";
.text
.align $align
.globl $func
EOF
push(@out,$tmp);
if ($main'cpp)
{ push(@out,"\tTYPE($func,\@function)\n"); }
else { push(@out,"\t.type $func,\@function\n"); }
push(@out,"$func:\n");
$stack=4;
}
sub main'function_end
{
local($func)=@_;
$func=$under.$func;
local($tmp)=<<"EOF";
popl %edi
popl %esi
popl %ebx
popl %ebp
ret
.${func}_end:
EOF
push(@out,$tmp);
if ($main'cpp)
{ push(@out,"\tSIZE($func,.${func}_end-$func)\n"); }
else { push(@out,"\t.size\t$func,.${func}_end-$func\n"); }
push(@out,".ident \"$func\"\n");
$stack=0;
%label=();
}
sub main'function_end_A
{
local($func)=@_;
local($tmp)=<<"EOF";
popl %edi
popl %esi
popl %ebx
popl %ebp
ret
EOF
push(@out,$tmp);
}
sub main'function_end_B
{
local($func)=@_;
$func=$under.$func;
push(@out,".${func}_end:\n");
if ($main'cpp)
{ push(@out,"\tSIZE($func,.${func}_end-$func)\n"); }
else { push(@out,"\t.size\t$func,.${func}_end-$func\n"); }
push(@out,".ident \"desasm.pl\"\n");
$stack=0;
%label=();
}
sub main'wparam
{
local($num)=@_;
return(&main'DWP($stack+$num*4,"esp","",0));
}
sub main'stack_push
{
local($num)=@_;
$stack+=$num*4;
&main'sub("esp",$num*4);
}
sub main'stack_pop
{
local($num)=@_;
$stack-=$num*4;
&main'add("esp",$num*4);
}
sub main'swtmp
{
return(&main'DWP($_[0]*4,"esp","",0));
}
# Should use swtmp, which is above esp. Linix can trash the stack above esp
#sub main'wtmp
# {
# local($num)=@_;
#
# return(&main'DWP(-($num+1)*4,"esp","",0));
# }
sub main'comment
{
foreach (@_)
{
if (/^\s*$/)
{ push(@out,"\n"); }
else
{ push(@out,"\t$com_start $_ $com_end\n"); }
}
}
sub main'label
{
if (!defined($label{$_[0]}))
{
$label{$_[0]}=".${label}${_[0]}";
$label++;
}
return($label{$_[0]});
}
sub main'set_label
{
if (!defined($label{$_[0]}))
{
$label{$_[0]}=".${label}${_[0]}";
$label++;
}
push(@out,".align $align\n") if ($_[1] != 0);
push(@out,"$label{$_[0]}:\n");
}
sub main'file_end
{
}
sub main'data_word
{
push(@out,"\t.long $_[0]\n");
}
linux/crypto/ciphers/des/asm/readme
+131
View File
@@ -0,0 +1,131 @@
First up, let me say I don't like writing in assembler. It is not portable,
dependant on the particular CPU architecture release and is generally a pig
to debug and get right. Having said that, the x86 architecture is probably
the most important for speed due to number of boxes and since
it appears to be the worst architecture to to get
good C compilers for. So due to this, I have lowered myself to do
assembler for the inner DES routines in libdes :-).
The file to implement in assembler is des_enc.c. Replace the following
4 functions
des_encrypt(DES_LONG data[2],des_key_schedule ks, int encrypt);
des_encrypt2(DES_LONG data[2],des_key_schedule ks, int encrypt);
des_encrypt3(DES_LONG data[2],des_key_schedule ks1,ks2,ks3);
des_decrypt3(DES_LONG data[2],des_key_schedule ks1,ks2,ks3);
They encrypt/decrypt the 64 bits held in 'data' using
the 'ks' key schedules. The only difference between the 4 functions is that
des_encrypt2() does not perform IP() or FP() on the data (this is an
optimization for when doing triple DES and des_encrypt3() and des_decrypt3()
perform triple des. The triple DES routines are in here because it does
make a big difference to have them located near the des_encrypt2 function
at link time..
Now as we all know, there are lots of different operating systems running on
x86 boxes, and unfortunately they normally try to make sure their assembler
formating is not the same as the other peoples.
The 4 main formats I know of are
Microsoft Windows 95/Windows NT
Elf Includes Linux and FreeBSD(?).
a.out The older Linux.
Solaris Same as Elf but different comments :-(.
Now I was not overly keen to write 4 different copies of the same code,
so I wrote a few perl routines to output the correct assembler, given
a target assembler type. This code is ugly and is just a hack.
The libraries are x86unix.pl and x86ms.pl.
des586.pl, des686.pl and des-som[23].pl are the programs to actually
generate the assembler.
So to generate elf assembler
perl des-som3.pl elf >dx86-elf.s
For Windows 95/NT
perl des-som2.pl win32 >win32.asm
[ update 4 Jan 1996 ]
I have added another way to do things.
perl des-som3.pl cpp >dx86-cpp.s
generates a file that will be included by dx86unix.cpp when it is compiled.
To build for elf, a.out, solaris, bsdi etc,
cc -E -DELF asm/dx86unix.cpp | as -o asm/dx86-elf.o
cc -E -DSOL asm/dx86unix.cpp | as -o asm/dx86-sol.o
cc -E -DOUT asm/dx86unix.cpp | as -o asm/dx86-out.o
cc -E -DBSDI asm/dx86unix.cpp | as -o asm/dx86bsdi.o
This was done to cut down the number of files in the distribution.
Now the ugly part. I acquired my copy of Intels
"Optimization's For Intel's 32-Bit Processors" and found a few interesting
things. First, the aim of the exersize is to 'extract' one byte at a time
from a word and do an array lookup. This involves getting the byte from
the 4 locations in the word and moving it to a new word and doing the lookup.
The most obvious way to do this is
xor eax, eax # clear word
movb al, cl # get low byte
xor edi DWORD PTR 0x100+des_SP[eax] # xor in word
movb al, ch # get next byte
xor edi DWORD PTR 0x300+des_SP[eax] # xor in word
shr ecx 16
which seems ok. For the pentium, this system appears to be the best.
One has to do instruction interleaving to keep both functional units
operating, but it is basically very efficient.
Now the crunch. When a full register is used after a partial write, eg.
mov al, cl
xor edi, DWORD PTR 0x100+des_SP[eax]
386 - 1 cycle stall
486 - 1 cycle stall
586 - 0 cycle stall
686 - at least 7 cycle stall (page 22 of the above mentioned document).
So the technique that produces the best results on a pentium, according to
the documentation, will produce hideous results on a pentium pro.
To get around this, des686.pl will generate code that is not as fast on
a pentium, should be very good on a pentium pro.
mov eax, ecx # copy word
shr ecx, 8 # line up next byte
and eax, 0fch # mask byte
xor edi DWORD PTR 0x100+des_SP[eax] # xor in array lookup
mov eax, ecx # get word
shr ecx 8 # line up next byte
and eax, 0fch # mask byte
xor edi DWORD PTR 0x300+des_SP[eax] # xor in array lookup
Due to the execution units in the pentium, this actually works quite well.
For a pentium pro it should be very good. This is the type of output
Visual C++ generates.
There is a third option. instead of using
mov al, ch
which is bad on the pentium pro, one may be able to use
movzx eax, ch
which may not incur the partial write penalty. On the pentium,
this instruction takes 4 cycles so is not worth using but on the
pentium pro it appears it may be worth while. I need access to one to
experiment :-).
eric (20 Oct 1996)
22 Nov 1996 - I have asked people to run the 2 different version on pentium
pros and it appears that the intel documentation is wrong. The
mov al,bh is still faster on a pentium pro, so just use the des586.pl
install des686.pl
3 Dec 1996 - I added des_encrypt3/des_decrypt3 because I have moved these
functions into des_enc.c because it does make a massive performance
difference on some boxes to have the functions code located close to
the des_encrypt2() function.
9 Jan 1997 - des-som2.pl is now the correct perl script to use for
pentiums. It contains an inner loop from
Svend Olaf Mikkelsen <[email protected]> which does raw ecb DES calls at
273,000 per second. He had a previous version at 250,000 and the best
I was able to get was 203,000. The content has not changed, this is all
due to instruction sequencing (and actual instructions choice) which is able
to keep both functional units of the pentium going.
We may have lost the ugly register usage restrictions when x86 went 32 bit
but for the pentium it has been replaced by evil instruction ordering tricks.
13 Jan 1997 - des-som3.pl, more optimizations from Svend Olaf.
raw DES at 281,000 per second on a pentium 100.
linux/crypto/ciphers/des/cbc_enc.c
+135
View File
@@ -0,0 +1,135 @@
/* crypto/des/cbc_enc.c */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
#include "des_locl.h"
void des_cbc_encrypt(input, output, length, schedule, ivec, enc)
des_cblock (*input);
des_cblock (*output);
long length;
des_key_schedule schedule;
des_cblock (*ivec);
int enc;
{
register DES_LONG tin0,tin1;
register DES_LONG tout0,tout1,xor0,xor1;
register unsigned char *in,*out;
register long l=length;
DES_LONG tin[2];
unsigned char *iv;
in=(unsigned char *)input;
out=(unsigned char *)output;
iv=(unsigned char *)ivec;
if (enc)
{
c2l(iv,tout0);
c2l(iv,tout1);
for (l-=8; l>=0; l-=8)
{
c2l(in,tin0);
c2l(in,tin1);
tin0^=tout0; tin[0]=tin0;
tin1^=tout1; tin[1]=tin1;
des_encrypt((DES_LONG *)tin,schedule,DES_ENCRYPT);
tout0=tin[0]; l2c(tout0,out);
tout1=tin[1]; l2c(tout1,out);
}
if (l != -8)
{
c2ln(in,tin0,tin1,l+8);
tin0^=tout0; tin[0]=tin0;
tin1^=tout1; tin[1]=tin1;
des_encrypt((DES_LONG *)tin,schedule,DES_ENCRYPT);
tout0=tin[0]; l2c(tout0,out);
tout1=tin[1]; l2c(tout1,out);
}
}
else
{
c2l(iv,xor0);
c2l(iv,xor1);
for (l-=8; l>=0; l-=8)
{
c2l(in,tin0); tin[0]=tin0;
c2l(in,tin1); tin[1]=tin1;
des_encrypt((DES_LONG *)tin,schedule,DES_DECRYPT);
tout0=tin[0]^xor0;
tout1=tin[1]^xor1;
l2c(tout0,out);
l2c(tout1,out);
xor0=tin0;
xor1=tin1;
}
if (l != -8)
{
c2l(in,tin0); tin[0]=tin0;
c2l(in,tin1); tin[1]=tin1;
des_encrypt((DES_LONG *)tin,schedule,DES_DECRYPT);
tout0=tin[0]^xor0;
tout1=tin[1]^xor1;
l2cn(tout0,tout1,out,l+8);
/* xor0=tin0;
xor1=tin1; */
}
}
tin0=tin1=tout0=tout1=xor0=xor1=0;
tin[0]=tin[1]=0;
}
linux/crypto/ciphers/des/des.doc
+505
View File
@@ -0,0 +1,505 @@
The DES library.
Please note that this library was originally written to operate with
eBones, a version of Kerberos that had had encryption removed when it left
the USA and then put back in. As such there are some routines that I will
advise not using but they are still in the library for historical reasons.
For all calls that have an 'input' and 'output' variables, they can be the
same.
This library requires the inclusion of 'des.h'.
All of the encryption functions take what is called a des_key_schedule as an
argument. A des_key_schedule is an expanded form of the des key.
A des_key is 8 bytes of odd parity, the type used to hold the key is a
des_cblock. A des_cblock is an array of 8 bytes, often in this library
description I will refer to input bytes when the function specifies
des_cblock's as input or output, this just means that the variable should
be a multiple of 8 bytes.
The define DES_ENCRYPT is passed to specify encryption, DES_DECRYPT to
specify decryption. The functions and global variable are as follows:
int des_check_key;
DES keys are supposed to be odd parity. If this variable is set to
a non-zero value, des_set_key() will check that the key has odd
parity and is not one of the known weak DES keys. By default this
variable is turned off;
void des_set_odd_parity(
des_cblock *key );
This function takes a DES key (8 bytes) and sets the parity to odd.
int des_is_weak_key(
des_cblock *key );
This function returns a non-zero value if the DES key passed is a
weak, DES key. If it is a weak key, don't use it, try a different
one. If you are using 'random' keys, the chances of hitting a weak
key are 1/2^52 so it is probably not worth checking for them.
int des_set_key(
des_cblock *key,
des_key_schedule schedule);
Des_set_key converts an 8 byte DES key into a des_key_schedule.
A des_key_schedule is an expanded form of the key which is used to
perform actual encryption. It can be regenerated from the DES key
so it only needs to be kept when encryption or decryption is about
to occur. Don't save or pass around des_key_schedule's since they
are CPU architecture dependent, DES keys are not. If des_check_key
is non zero, zero is returned if the key has the wrong parity or
the key is a weak key, else 1 is returned.
int des_key_sched(
des_cblock *key,
des_key_schedule schedule);
An alternative name for des_set_key().
int des_rw_mode; /* defaults to DES_PCBC_MODE */
This flag holds either DES_CBC_MODE or DES_PCBC_MODE (default).
This specifies the function to use in the enc_read() and enc_write()
functions.
void des_encrypt(
unsigned long *data,
des_key_schedule ks,
int enc);
This is the DES encryption function that gets called by just about
every other DES routine in the library. You should not use this
function except to implement 'modes' of DES. I say this because the
functions that call this routine do the conversion from 'char *' to
long, and this needs to be done to make sure 'non-aligned' memory
access do not occur. The characters are loaded 'little endian',
have a look at my source code for more details on how I use this
function.
Data is a pointer to 2 unsigned long's and ks is the
des_key_schedule to use. enc, is non zero specifies encryption,
zero if decryption.
void des_encrypt2(
unsigned long *data,
des_key_schedule ks,
int enc);
This functions is the same as des_encrypt() except that the DES
initial permutation (IP) and final permutation (FP) have been left
out. As for des_encrypt(), you should not use this function.
It is used by the routines in my library that implement triple DES.
IP() des_encrypt2() des_encrypt2() des_encrypt2() FP() is the same
as des_encrypt() des_encrypt() des_encrypt() except faster :-).
void des_ecb_encrypt(
des_cblock *input,
des_cblock *output,
des_key_schedule ks,
int enc);
This is the basic Electronic Code Book form of DES, the most basic
form. Input is encrypted into output using the key represented by
ks. If enc is non zero (DES_ENCRYPT), encryption occurs, otherwise
decryption occurs. Input is 8 bytes long and output is 8 bytes.
(the des_cblock structure is 8 chars).
void des_ecb3_encrypt(
des_cblock *input,
des_cblock *output,
des_key_schedule ks1,
des_key_schedule ks2,
des_key_schedule ks3,
int enc);
This is the 3 key EDE mode of ECB DES. What this means is that
the 8 bytes of input is encrypted with ks1, decrypted with ks2 and
then encrypted again with ks3, before being put into output;
C=E(ks3,D(ks2,E(ks1,M))). There is a macro, des_ecb2_encrypt()
that only takes 2 des_key_schedules that implements,
C=E(ks1,D(ks2,E(ks1,M))) in that the final encrypt is done with ks1.
void des_cbc_encrypt(
des_cblock *input,
des_cblock *output,
long length,
des_key_schedule ks,
des_cblock *ivec,
int enc);
This routine implements DES in Cipher Block Chaining mode.
Input, which should be a multiple of 8 bytes is encrypted
(or decrypted) to output which will also be a multiple of 8 bytes.
The number of bytes is in length (and from what I've said above,
should be a multiple of 8). If length is not a multiple of 8, I'm
not being held responsible :-). ivec is the initialisation vector.
This function does not modify this variable. To correctly implement
cbc mode, you need to do one of 2 things; copy the last 8 bytes of
cipher text for use as the next ivec in your application,
or use des_ncbc_encrypt().
Only this routine has this problem with updating the ivec, all
other routines that are implementing cbc mode update ivec.
void des_ncbc_encrypt(
des_cblock *input,
des_cblock *output,
long length,
des_key_schedule sk,
des_cblock *ivec,
int enc);
For historical reasons, des_cbc_encrypt() did not update the
ivec with the value requires so that subsequent calls to
des_cbc_encrypt() would 'chain'. This was needed so that the same
'length' values would not need to be used when decrypting.
des_ncbc_encrypt() does the right thing. It is the same as
des_cbc_encrypt accept that ivec is updates with the correct value
to pass in subsequent calls to des_ncbc_encrypt(). I advise using
des_ncbc_encrypt() instead of des_cbc_encrypt();
void des_xcbc_encrypt(
des_cblock *input,
des_cblock *output,
long length,
des_key_schedule sk,
des_cblock *ivec,
des_cblock *inw,
des_cblock *outw,
int enc);
This is RSA's DESX mode of DES. It uses inw and outw to
'whiten' the encryption. inw and outw are secret (unlike the iv)
and are as such, part of the key. So the key is sort of 24 bytes.
This is much better than cbc des.
void des_3cbc_encrypt(
des_cblock *input,
des_cblock *output,
long length,
des_key_schedule sk1,
des_key_schedule sk2,
des_cblock *ivec1,
des_cblock *ivec2,
int enc);
This function is flawed, do not use it. I have left it in the
library because it is used in my des(1) program and will function
correctly when used by des(1). If I removed the function, people
could end up unable to decrypt files.
This routine implements outer triple cbc encryption using 2 ks and
2 ivec's. Use des_ede2_cbc_encrypt() instead.
void des_ede3_cbc_encrypt(
des_cblock *input,
des_cblock *output,
long length,
des_key_schedule ks1,
des_key_schedule ks2,
des_key_schedule ks3,
des_cblock *ivec,
int enc);
This function implements inner triple CBC DES encryption with 3
keys. What this means is that each 'DES' operation
inside the cbc mode is really an C=E(ks3,D(ks2,E(ks1,M))).
Again, this is cbc mode so an ivec is requires.
This mode is used by SSL.
There is also a des_ede2_cbc_encrypt() that only uses 2
des_key_schedule's, the first being reused for the final
encryption. C=E(ks1,D(ks2,E(ks1,M))). This form of triple DES
is used by the RSAref library.
void des_pcbc_encrypt(
des_cblock *input,
des_cblock *output,
long length,
des_key_schedule ks,
des_cblock *ivec,
int enc);
This is Propagating Cipher Block Chaining mode of DES. It is used
by Kerberos v4. It's parameters are the same as des_ncbc_encrypt().
void des_cfb_encrypt(
unsigned char *in,
unsigned char *out,
int numbits,
long length,
des_key_schedule ks,
des_cblock *ivec,
int enc);
Cipher Feedback Back mode of DES. This implementation 'feeds back'
in numbit blocks. The input (and output) is in multiples of numbits
bits. numbits should to be a multiple of 8 bits. Length is the
number of bytes input. If numbits is not a multiple of 8 bits,
the extra bits in the bytes will be considered padding. So if
numbits is 12, for each 2 input bytes, the 4 high bits of the
second byte will be ignored. So to encode 72 bits when using
a numbits of 12 take 12 bytes. To encode 72 bits when using
numbits of 9 will take 16 bytes. To encode 80 bits when using
numbits of 16 will take 10 bytes. etc, etc. This padding will
apply to both input and output.
void des_cfb64_encrypt(
unsigned char *in,
unsigned char *out,
long length,
des_key_schedule ks,
des_cblock *ivec,
int *num,
int enc);
This is one of the more useful functions in this DES library, it
implements CFB mode of DES with 64bit feedback. Why is this
useful you ask? Because this routine will allow you to encrypt an
arbitrary number of bytes, no 8 byte padding. Each call to this
routine will encrypt the input bytes to output and then update ivec
and num. num contains 'how far' we are though ivec. If this does
not make much sense, read more about cfb mode of DES :-).
void des_ede3_cfb64_encrypt(
unsigned char *in,
unsigned char *out,
long length,
des_key_schedule ks1,
des_key_schedule ks2,
des_key_schedule ks3,
des_cblock *ivec,
int *num,
int enc);
Same as des_cfb64_encrypt() accept that the DES operation is
triple DES. As usual, there is a macro for
des_ede2_cfb64_encrypt() which reuses ks1.
void des_ofb_encrypt(
unsigned char *in,
unsigned char *out,
int numbits,
long length,
des_key_schedule ks,
des_cblock *ivec);
This is a implementation of Output Feed Back mode of DES. It is
the same as des_cfb_encrypt() in that numbits is the size of the
units dealt with during input and output (in bits).
void des_ofb64_encrypt(
unsigned char *in,
unsigned char *out,
long length,
des_key_schedule ks,
des_cblock *ivec,
int *num);
The same as des_cfb64_encrypt() except that it is Output Feed Back
mode.
void des_ede3_ofb64_encrypt(
unsigned char *in,
unsigned char *out,
long length,
des_key_schedule ks1,
des_key_schedule ks2,
des_key_schedule ks3,
des_cblock *ivec,
int *num);
Same as des_ofb64_encrypt() accept that the DES operation is
triple DES. As usual, there is a macro for
des_ede2_ofb64_encrypt() which reuses ks1.
int des_read_pw_string(
char *buf,
int length,
char *prompt,
int verify);
This routine is used to get a password from the terminal with echo
turned off. Buf is where the string will end up and length is the
size of buf. Prompt is a string presented to the 'user' and if
verify is set, the key is asked for twice and unless the 2 copies
match, an error is returned. A return code of -1 indicates a
system error, 1 failure due to use interaction, and 0 is success.
unsigned long des_cbc_cksum(
des_cblock *input,
des_cblock *output,
long length,
des_key_schedule ks,
des_cblock *ivec);
This function produces an 8 byte checksum from input that it puts in
output and returns the last 4 bytes as a long. The checksum is
generated via cbc mode of DES in which only the last 8 byes are
kept. I would recommend not using this function but instead using
the EVP_Digest routines, or at least using MD5 or SHA. This
function is used by Kerberos v4 so that is why it stays in the
library.
char *des_fcrypt(
const char *buf,
const char *salt
char *ret);
This is my fast version of the unix crypt(3) function. This version
takes only a small amount of space relative to other fast
crypt() implementations. This is different to the normal crypt
in that the third parameter is the buffer that the return value
is written into. It needs to be at least 14 bytes long. This
function is thread safe, unlike the normal crypt.
char *crypt(
const char *buf,
const char *salt);
This function calls des_fcrypt() with a static array passed as the
third parameter. This emulates the normal non-thread safe semantics
of crypt(3).
void des_string_to_key(
char *str,
des_cblock *key);
This function takes str and converts it into a DES key. I would
recommend using MD5 instead and use the first 8 bytes of output.
When I wrote the first version of these routines back in 1990, MD5
did not exist but I feel these routines are still sound. This
routines is compatible with the one in MIT's libdes.
void des_string_to_2keys(
char *str,
des_cblock *key1,
des_cblock *key2);
This function takes str and converts it into 2 DES keys.
I would recommend using MD5 and using the 16 bytes as the 2 keys.
I have nothing against these 2 'string_to_key' routines, it's just
that if you say that your encryption key is generated by using the
16 bytes of an MD5 hash, every-one knows how you generated your
keys.
int des_read_password(
des_cblock *key,
char *prompt,
int verify);
This routine combines des_read_pw_string() with des_string_to_key().
int des_read_2passwords(
des_cblock *key1,
des_cblock *key2,
char *prompt,
int verify);
This routine combines des_read_pw_string() with des_string_to_2key().
void des_random_seed(
des_cblock key);
This routine sets a starting point for des_random_key().
void des_random_key(
des_cblock ret);
This function return a random key. Make sure to 'seed' the random
number generator (with des_random_seed()) before using this function.
I personally now use a MD5 based random number system.
int des_enc_read(
int fd,
char *buf,
int len,
des_key_schedule ks,
des_cblock *iv);
This function will write to a file descriptor the encrypted data
from buf. This data will be preceded by a 4 byte 'byte count' and
will be padded out to 8 bytes. The encryption is either CBC of
PCBC depending on the value of des_rw_mode. If it is DES_PCBC_MODE,
pcbc is used, if DES_CBC_MODE, cbc is used. The default is to use
DES_PCBC_MODE.
int des_enc_write(
int fd,
char *buf,
int len,
des_key_schedule ks,
des_cblock *iv);
This routines read stuff written by des_enc_read() and decrypts it.
I have used these routines quite a lot but I don't believe they are
suitable for non-blocking io. If you are after a full
authentication/encryption over networks, have a look at SSL instead.
unsigned long des_quad_cksum(
des_cblock *input,
des_cblock *output,
long length,
int out_count,
des_cblock *seed);
This is a function from Kerberos v4 that is not anything to do with
DES but was needed. It is a cksum that is quicker to generate than
des_cbc_cksum(); I personally would use MD5 routines now.
=====
Modes of DES
Quite a bit of the following information has been taken from
AS 2805.5.2
Australian Standard
Electronic funds transfer - Requirements for interfaces,
Part 5.2: Modes of operation for an n-bit block cipher algorithm
Appendix A
There are several different modes in which DES can be used, they are
as follows.
Electronic Codebook Mode (ECB) (des_ecb_encrypt())
- 64 bits are enciphered at a time.
- The order of the blocks can be rearranged without detection.
- The same plaintext block always produces the same ciphertext block
(for the same key) making it vulnerable to a 'dictionary attack'.
- An error will only affect one ciphertext block.
Cipher Block Chaining Mode (CBC) (des_cbc_encrypt())
- a multiple of 64 bits are enciphered at a time.
- The CBC mode produces the same ciphertext whenever the same
plaintext is encrypted using the same key and starting variable.
- The chaining operation makes the ciphertext blocks dependent on the
current and all preceding plaintext blocks and therefore blocks can not
be rearranged.
- The use of different starting variables prevents the same plaintext
enciphering to the same ciphertext.
- An error will affect the current and the following ciphertext blocks.
Cipher Feedback Mode (CFB) (des_cfb_encrypt())
- a number of bits (j) <= 64 are enciphered at a time.
- The CFB mode produces the same ciphertext whenever the same
plaintext is encrypted using the same key and starting variable.
- The chaining operation makes the ciphertext variables dependent on the
current and all preceding variables and therefore j-bit variables are
chained together and can not be rearranged.
- The use of different starting variables prevents the same plaintext
enciphering to the same ciphertext.
- The strength of the CFB mode depends on the size of k (maximal if
j == k). In my implementation this is always the case.
- Selection of a small value for j will require more cycles through
the encipherment algorithm per unit of plaintext and thus cause
greater processing overheads.
- Only multiples of j bits can be enciphered.
- An error will affect the current and the following ciphertext variables.
Output Feedback Mode (OFB) (des_ofb_encrypt())
- a number of bits (j) <= 64 are enciphered at a time.
- The OFB mode produces the same ciphertext whenever the same
plaintext enciphered using the same key and starting variable. More
over, in the OFB mode the same key stream is produced when the same
key and start variable are used. Consequently, for security reasons
a specific start variable should be used only once for a given key.
- The absence of chaining makes the OFB more vulnerable to specific attacks.
- The use of different start variables values prevents the same
plaintext enciphering to the same ciphertext, by producing different
key streams.
- Selection of a small value for j will require more cycles through
the encipherment algorithm per unit of plaintext and thus cause
greater processing overheads.
- Only multiples of j bits can be enciphered.
- OFB mode of operation does not extend ciphertext errors in the
resultant plaintext output. Every bit error in the ciphertext causes
only one bit to be in error in the deciphered plaintext.
- OFB mode is not self-synchronising. If the two operation of
encipherment and decipherment get out of synchronism, the system needs
to be re-initialised.
- Each re-initialisation should use a value of the start variable
different from the start variable values used before with the same
key. The reason for this is that an identical bit stream would be
produced each time from the same parameters. This would be
susceptible to a ' known plaintext' attack.
Triple ECB Mode (des_ecb3_encrypt())
- Encrypt with key1, decrypt with key2 and encrypt with key3 again.
- As for ECB encryption but increases the key length to 168 bits.
There are theoretic attacks that can be used that make the effective
key length 112 bits, but this attack also requires 2^56 blocks of
memory, not very likely, even for the NSA.
- If both keys are the same it is equivalent to encrypting once with
just one key.
- If the first and last key are the same, the key length is 112 bits.
There are attacks that could reduce the key space to 55 bit's but it
requires 2^56 blocks of memory.
- If all 3 keys are the same, this is effectively the same as normal
ecb mode.
Triple CBC Mode (des_ede3_cbc_encrypt())
- Encrypt with key1, decrypt with key2 and then encrypt with key3.
- As for CBC encryption but increases the key length to 168 bits with
the same restrictions as for triple ecb mode.
linux/crypto/ciphers/des/des_crypt.man
+508
View File
@@ -0,0 +1,508 @@
.TH DES_CRYPT 3
.SH NAME
des_read_password, des_read_2password,
des_string_to_key, des_string_to_2key, des_read_pw_string,
des_random_key, des_set_key,
des_key_sched, des_ecb_encrypt, des_ecb3_encrypt, des_cbc_encrypt,
des_3cbc_encrypt,
des_pcbc_encrypt, des_cfb_encrypt, des_ofb_encrypt,
des_cbc_cksum, des_quad_cksum,
des_enc_read, des_enc_write, des_set_odd_parity,
des_is_weak_key, crypt \- (non USA) DES encryption
.SH SYNOPSIS
.nf
.nj
.ft B
#include <des.h>
.PP
.B int des_read_password(key,prompt,verify)
des_cblock *key;
char *prompt;
int verify;
.PP
.B int des_read_2password(key1,key2,prompt,verify)
des_cblock *key1,*key2;
char *prompt;
int verify;
.PP
.B int des_string_to_key(str,key)
char *str;
des_cblock *key;
.PP
.B int des_string_to_2keys(str,key1,key2)
char *str;
des_cblock *key1,*key2;
.PP
.B int des_read_pw_string(buf,length,prompt,verify)
char *buf;
int length;
char *prompt;
int verify;
.PP
.B int des_random_key(key)
des_cblock *key;
.PP
.B int des_set_key(key,schedule)
des_cblock *key;
des_key_schedule schedule;
.PP
.B int des_key_sched(key,schedule)
des_cblock *key;
des_key_schedule schedule;
.PP
.B int des_ecb_encrypt(input,output,schedule,encrypt)
des_cblock *input;
des_cblock *output;
des_key_schedule schedule;
int encrypt;
.PP
.B int des_ecb3_encrypt(input,output,ks1,ks2,encrypt)
des_cblock *input;
des_cblock *output;
des_key_schedule ks1,ks2;
int encrypt;
.PP
.B int des_cbc_encrypt(input,output,length,schedule,ivec,encrypt)
des_cblock *input;
des_cblock *output;
long length;
des_key_schedule schedule;
des_cblock *ivec;
int encrypt;
.PP
.B int des_3cbc_encrypt(input,output,length,sk1,sk2,ivec1,ivec2,encrypt)
des_cblock *input;
des_cblock *output;
long length;
des_key_schedule sk1;
des_key_schedule sk2;
des_cblock *ivec1;
des_cblock *ivec2;
int encrypt;
.PP
.B int des_pcbc_encrypt(input,output,length,schedule,ivec,encrypt)
des_cblock *input;
des_cblock *output;
long length;
des_key_schedule schedule;
des_cblock *ivec;
int encrypt;
.PP
.B int des_cfb_encrypt(input,output,numbits,length,schedule,ivec,encrypt)
unsigned char *input;
unsigned char *output;
int numbits;
long length;
des_key_schedule schedule;
des_cblock *ivec;
int encrypt;
.PP
.B int des_ofb_encrypt(input,output,numbits,length,schedule,ivec)
unsigned char *input,*output;
int numbits;
long length;
des_key_schedule schedule;
des_cblock *ivec;
.PP
.B unsigned long des_cbc_cksum(input,output,length,schedule,ivec)
des_cblock *input;
des_cblock *output;
long length;
des_key_schedule schedule;
des_cblock *ivec;
.PP
.B unsigned long des_quad_cksum(input,output,length,out_count,seed)
des_cblock *input;
des_cblock *output;
long length;
int out_count;
des_cblock *seed;
.PP
.B int des_check_key;
.PP
.B int des_enc_read(fd,buf,len,sched,iv)
int fd;
char *buf;
int len;
des_key_schedule sched;
des_cblock *iv;
.PP
.B int des_enc_write(fd,buf,len,sched,iv)
int fd;
char *buf;
int len;
des_key_schedule sched;
des_cblock *iv;
.PP
.B extern int des_rw_mode;
.PP
.B void des_set_odd_parity(key)
des_cblock *key;
.PP
.B int des_is_weak_key(key)
des_cblock *key;
.PP
.B char *crypt(passwd,salt)
char *passwd;
char *salt;
.PP
.fi
.SH DESCRIPTION
This library contains a fast implementation of the DES encryption
algorithm.
.PP
There are two phases to the use of DES encryption.
The first is the generation of a
.I des_key_schedule
from a key,
the second is the actual encryption.
A des key is of type
.I des_cblock.
This type is made from 8 characters with odd parity.
The least significant bit in the character is the parity bit.
The key schedule is an expanded form of the key; it is used to speed the
encryption process.
.PP
.I des_read_password
writes the string specified by prompt to the standard output,
turns off echo and reads an input string from standard input
until terminated with a newline.
If verify is non-zero, it prompts and reads the input again and verifies
that both entered passwords are the same.
The entered string is converted into a des key by using the
.I des_string_to_key
routine.
The new key is placed in the
.I des_cblock
that was passed (by reference) to the routine.
If there were no errors,
.I des_read_password
returns 0,
-1 is returned if there was a terminal error and 1 is returned for
any other error.
.PP
.I des_read_2password
operates in the same way as
.I des_read_password
except that it generates 2 keys by using the
.I des_string_to_2key
function.
.PP
.I des_read_pw_string
is called by
.I des_read_password
to read and verify a string from a terminal device.
The string is returned in
.I buf.
The size of
.I buf
is passed to the routine via the
.I length
parameter.
.PP
.I des_string_to_key
converts a string into a valid des key.
.PP
.I des_string_to_2key
converts a string into 2 valid des keys.
This routine is best suited for used to generate keys for use with
.I des_ecb3_encrypt.
.PP
.I des_random_key
returns a random key that is made of a combination of process id,
time and an increasing counter.
.PP
Before a des key can be used it is converted into a
.I des_key_schedule
via the
.I des_set_key
routine.
If the
.I des_check_key
flag is non-zero,
.I des_set_key
will check that the key passed is of odd parity and is not a week or
semi-weak key.
If the parity is wrong,
then -1 is returned.
If the key is a weak key,
then -2 is returned.
If an error is returned,
the key schedule is not generated.
.PP
.I des_key_sched
is another name for the
.I des_set_key
function.
.PP
The following routines mostly operate on an input and output stream of
.I des_cblock's.
.PP
.I des_ecb_encrypt
is the basic DES encryption routine that encrypts or decrypts a single 8-byte
.I des_cblock
in
.I electronic code book
mode.
It always transforms the input data, pointed to by
.I input,
into the output data,
pointed to by the
.I output
argument.
If the
.I encrypt
argument is non-zero (DES_ENCRYPT),
the
.I input
(cleartext) is encrypted in to the
.I output
(ciphertext) using the key_schedule specified by the
.I schedule
argument,
previously set via
.I des_set_key.
If
.I encrypt
is zero (DES_DECRYPT),
the
.I input
(now ciphertext)
is decrypted into the
.I output
(now cleartext).
Input and output may overlap.
No meaningful value is returned.
.PP
.I des_ecb3_encrypt
encrypts/decrypts the
.I input
block by using triple ecb DES encryption.
This involves encrypting the input with
.I ks1,
decryption with the key schedule
.I ks2,
and then encryption with the first again.
This routine greatly reduces the chances of brute force breaking of
DES and has the advantage of if
.I ks1
and
.I ks2
are the same, it is equivalent to just encryption using ecb mode and
.I ks1
as the key.
.PP
.I des_cbc_encrypt
encrypts/decrypts using the
.I cipher-block-chaining
mode of DES.
If the
.I encrypt
argument is non-zero,
the routine cipher-block-chain encrypts the cleartext data pointed to by the
.I input
argument into the ciphertext pointed to by the
.I output
argument,
using the key schedule provided by the
.I schedule
argument,
and initialisation vector provided by the
.I ivec
argument.
If the
.I length
argument is not an integral multiple of eight bytes,
the last block is copied to a temporary area and zero filled.
The output is always
an integral multiple of eight bytes.
To make multiple cbc encrypt calls on a large amount of data appear to
be one
.I des_cbc_encrypt
call, the
.I ivec
of subsequent calls should be the last 8 bytes of the output.
.PP
.I des_3cbc_encrypt
encrypts/decrypts the
.I input
block by using triple cbc DES encryption.
This involves encrypting the input with key schedule
.I ks1,
decryption with the key schedule
.I ks2,
and then encryption with the first again.
2 initialisation vectors are required,
.I ivec1
and
.I ivec2.
Unlike
.I des_cbc_encrypt,
these initialisation vectors are modified by the subroutine.
This routine greatly reduces the chances of brute force breaking of
DES and has the advantage of if
.I ks1
and
.I ks2
are the same, it is equivalent to just encryption using cbc mode and
.I ks1
as the key.
.PP
.I des_pcbc_encrypt
encrypt/decrypts using a modified block chaining mode.
It provides better error propagation characteristics than cbc
encryption.
.PP
.I des_cfb_encrypt
encrypt/decrypts using cipher feedback mode. This method takes an
array of characters as input and outputs and array of characters. It
does not require any padding to 8 character groups. Note: the ivec
variable is changed and the new changed value needs to be passed to
the next call to this function. Since this function runs a complete
DES ecb encryption per numbits, this function is only suggested for
use when sending small numbers of characters.
.PP
.I des_ofb_encrypt
encrypt using output feedback mode. This method takes an
array of characters as input and outputs and array of characters. It
does not require any padding to 8 character groups. Note: the ivec
variable is changed and the new changed value needs to be passed to
the next call to this function. Since this function runs a complete
DES ecb encryption per numbits, this function is only suggested for
use when sending small numbers of characters.
.PP
.I des_cbc_cksum
produces an 8 byte checksum based on the input stream (via cbc encryption).
The last 4 bytes of the checksum is returned and the complete 8 bytes is
placed in
.I output.
.PP
.I des_quad_cksum
returns a 4 byte checksum from the input bytes.
The algorithm can be iterated over the input,
depending on
.I out_count,
1, 2, 3 or 4 times.
If
.I output
is non-NULL,
the 8 bytes generated by each pass are written into
.I output.
.PP
.I des_enc_write
is used to write
.I len
bytes
to file descriptor
.I fd
from buffer
.I buf.
The data is encrypted via
.I pcbc_encrypt
(default) using
.I sched
for the key and
.I iv
as a starting vector.
The actual data send down
.I fd
consists of 4 bytes (in network byte order) containing the length of the
following encrypted data. The encrypted data then follows, padded with random
data out to a multiple of 8 bytes.
.PP
.I des_enc_read
is used to read
.I len
bytes
from file descriptor
.I fd
into buffer
.I buf.
The data being read from
.I fd
is assumed to have come from
.I des_enc_write
and is decrypted using
.I sched
for the key schedule and
.I iv
for the initial vector.
The
.I des_enc_read/des_enc_write
pair can be used to read/write to files, pipes and sockets.
I have used them in implementing a version of rlogin in which all
data is encrypted.
.PP
.I des_rw_mode
is used to specify the encryption mode to use with
.I des_enc_read
and
.I des_end_write.
If set to
.I DES_PCBC_MODE
(the default), des_pcbc_encrypt is used.
If set to
.I DES_CBC_MODE
des_cbc_encrypt is used.
These two routines and the variable are not part of the normal MIT library.
.PP
.I des_set_odd_parity
sets the parity of the passed
.I key
to odd. This routine is not part of the standard MIT library.
.PP
.I des_is_weak_key
returns 1 is the passed key is a weak key (pick again :-),
0 if it is ok.
This routine is not part of the standard MIT library.
.PP
.I crypt
is a replacement for the normal system crypt.
It is much faster than the system crypt.
.PP
.SH FILES
/usr/include/des.h
.br
/usr/lib/libdes.a
.PP
The encryption routines have been tested on 16bit, 32bit and 64bit
machines of various endian and even works under VMS.
.PP
.SH BUGS
.PP
If you think this manual is sparse,
read the des_crypt(3) manual from the MIT kerberos (or bones outside
of the USA) distribution.
.PP
.I des_cfb_encrypt
and
.I des_ofb_encrypt
operates on input of 8 bits. What this means is that if you set
numbits to 12, and length to 2, the first 12 bits will come from the 1st
input byte and the low half of the second input byte. The second 12
bits will have the low 8 bits taken from the 3rd input byte and the
top 4 bits taken from the 4th input byte. The same holds for output.
This function has been implemented this way because most people will
be using a multiple of 8 and because once you get into pulling bytes input
bytes apart things get ugly!
.PP
.I des_read_pw_string
is the most machine/OS dependent function and normally generates the
most problems when porting this code.
.PP
.I des_string_to_key
is probably different from the MIT version since there are lots
of fun ways to implement one-way encryption of a text string.
.PP
The routines are optimised for 32 bit machines and so are not efficient
on IBM PCs.
.PP
NOTE: extensive work has been done on this library since this document
was origionally written. Please try to read des.doc from the libdes
distribution since it is far more upto date and documents more of the
functions. Libdes is now also being shipped as part of SSLeay, a
general cryptographic library that amonst other things implements
netscapes SSL protocoll. The most recent version can be found in
SSLeay distributions.
.SH AUTHOR
Eric Young ([email protected])
linux/crypto/ciphers/des/des_enc.c
+502
View File
@@ -0,0 +1,502 @@
/* crypto/des/des_enc.c */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
#include "des_locl.h"
void des_encrypt(data, ks, enc)
DES_LONG *data;
des_key_schedule ks;
int enc;
{
register DES_LONG l,r,t,u;
#ifdef DES_PTR
register unsigned char *des_SP=(unsigned char *)des_SPtrans;
#endif
#ifndef DES_UNROLL
register int i;
#endif
register DES_LONG *s;
r=data[0];
l=data[1];
IP(r,l);
/* Things have been modified so that the initial rotate is
* done outside the loop. This required the
* des_SPtrans values in sp.h to be rotated 1 bit to the right.
* One perl script later and things have a 5% speed up on a sparc2.
* Thanks to Richard Outerbridge <[email protected]>
* for pointing this out. */
/* clear the top bits on machines with 8byte longs */
/* shift left by 2 */
r=ROTATE(r,29)&0xffffffffL;
l=ROTATE(l,29)&0xffffffffL;
s=(DES_LONG *)ks;
/* I don't know if it is worth the effort of loop unrolling the
* inner loop */
if (enc)
{
#ifdef DES_UNROLL
D_ENCRYPT(l,r, 0); /* 1 */
D_ENCRYPT(r,l, 2); /* 2 */
D_ENCRYPT(l,r, 4); /* 3 */
D_ENCRYPT(r,l, 6); /* 4 */
D_ENCRYPT(l,r, 8); /* 5 */
D_ENCRYPT(r,l,10); /* 6 */
D_ENCRYPT(l,r,12); /* 7 */
D_ENCRYPT(r,l,14); /* 8 */
D_ENCRYPT(l,r,16); /* 9 */
D_ENCRYPT(r,l,18); /* 10 */
D_ENCRYPT(l,r,20); /* 11 */
D_ENCRYPT(r,l,22); /* 12 */
D_ENCRYPT(l,r,24); /* 13 */
D_ENCRYPT(r,l,26); /* 14 */
D_ENCRYPT(l,r,28); /* 15 */
D_ENCRYPT(r,l,30); /* 16 */
#else
for (i=0; i<32; i+=8)
{
D_ENCRYPT(l,r,i+0); /* 1 */
D_ENCRYPT(r,l,i+2); /* 2 */
D_ENCRYPT(l,r,i+4); /* 3 */
D_ENCRYPT(r,l,i+6); /* 4 */
}
#endif
}
else
{
#ifdef DES_UNROLL
D_ENCRYPT(l,r,30); /* 16 */
D_ENCRYPT(r,l,28); /* 15 */
D_ENCRYPT(l,r,26); /* 14 */
D_ENCRYPT(r,l,24); /* 13 */
D_ENCRYPT(l,r,22); /* 12 */
D_ENCRYPT(r,l,20); /* 11 */
D_ENCRYPT(l,r,18); /* 10 */
D_ENCRYPT(r,l,16); /* 9 */
D_ENCRYPT(l,r,14); /* 8 */
D_ENCRYPT(r,l,12); /* 7 */
D_ENCRYPT(l,r,10); /* 6 */
D_ENCRYPT(r,l, 8); /* 5 */
D_ENCRYPT(l,r, 6); /* 4 */
D_ENCRYPT(r,l, 4); /* 3 */
D_ENCRYPT(l,r, 2); /* 2 */
D_ENCRYPT(r,l, 0); /* 1 */
#else
for (i=30; i>0; i-=8)
{
D_ENCRYPT(l,r,i-0); /* 16 */
D_ENCRYPT(r,l,i-2); /* 15 */
D_ENCRYPT(l,r,i-4); /* 14 */
D_ENCRYPT(r,l,i-6); /* 13 */
}
#endif
}
/* rotate and clear the top bits on machines with 8byte longs */
l=ROTATE(l,3)&0xffffffffL;
r=ROTATE(r,3)&0xffffffffL;
FP(r,l);
data[0]=l;
data[1]=r;
l=r=t=u=0;
}
void des_encrypt2(data, ks, enc)
DES_LONG *data;
des_key_schedule ks;
int enc;
{
register DES_LONG l,r,t,u;
#ifdef DES_PTR
register unsigned char *des_SP=(unsigned char *)des_SPtrans;
#endif
#ifndef DES_UNROLL
register int i;
#endif
register DES_LONG *s;
r=data[0];
l=data[1];
/* Things have been modified so that the initial rotate is
* done outside the loop. This required the
* des_SPtrans values in sp.h to be rotated 1 bit to the right.
* One perl script later and things have a 5% speed up on a sparc2.
* Thanks to Richard Outerbridge <[email protected]>
* for pointing this out. */
/* clear the top bits on machines with 8byte longs */
r=ROTATE(r,29)&0xffffffffL;
l=ROTATE(l,29)&0xffffffffL;
s=(DES_LONG *)ks;
/* I don't know if it is worth the effort of loop unrolling the
* inner loop */
if (enc)
{
#ifdef DES_UNROLL
D_ENCRYPT(l,r, 0); /* 1 */
D_ENCRYPT(r,l, 2); /* 2 */
D_ENCRYPT(l,r, 4); /* 3 */
D_ENCRYPT(r,l, 6); /* 4 */
D_ENCRYPT(l,r, 8); /* 5 */
D_ENCRYPT(r,l,10); /* 6 */
D_ENCRYPT(l,r,12); /* 7 */
D_ENCRYPT(r,l,14); /* 8 */
D_ENCRYPT(l,r,16); /* 9 */
D_ENCRYPT(r,l,18); /* 10 */
D_ENCRYPT(l,r,20); /* 11 */
D_ENCRYPT(r,l,22); /* 12 */
D_ENCRYPT(l,r,24); /* 13 */
D_ENCRYPT(r,l,26); /* 14 */
D_ENCRYPT(l,r,28); /* 15 */
D_ENCRYPT(r,l,30); /* 16 */
#else
for (i=0; i<32; i+=8)
{
D_ENCRYPT(l,r,i+0); /* 1 */
D_ENCRYPT(r,l,i+2); /* 2 */
D_ENCRYPT(l,r,i+4); /* 3 */
D_ENCRYPT(r,l,i+6); /* 4 */
}
#endif
}
else
{
#ifdef DES_UNROLL
D_ENCRYPT(l,r,30); /* 16 */
D_ENCRYPT(r,l,28); /* 15 */
D_ENCRYPT(l,r,26); /* 14 */
D_ENCRYPT(r,l,24); /* 13 */
D_ENCRYPT(l,r,22); /* 12 */
D_ENCRYPT(r,l,20); /* 11 */
D_ENCRYPT(l,r,18); /* 10 */
D_ENCRYPT(r,l,16); /* 9 */
D_ENCRYPT(l,r,14); /* 8 */
D_ENCRYPT(r,l,12); /* 7 */
D_ENCRYPT(l,r,10); /* 6 */
D_ENCRYPT(r,l, 8); /* 5 */
D_ENCRYPT(l,r, 6); /* 4 */
D_ENCRYPT(r,l, 4); /* 3 */
D_ENCRYPT(l,r, 2); /* 2 */
D_ENCRYPT(r,l, 0); /* 1 */
#else
for (i=30; i>0; i-=8)
{
D_ENCRYPT(l,r,i-0); /* 16 */
D_ENCRYPT(r,l,i-2); /* 15 */
D_ENCRYPT(l,r,i-4); /* 14 */
D_ENCRYPT(r,l,i-6); /* 13 */
}
#endif
}
/* rotate and clear the top bits on machines with 8byte longs */
data[0]=ROTATE(l,3)&0xffffffffL;
data[1]=ROTATE(r,3)&0xffffffffL;
l=r=t=u=0;
}
void des_encrypt3(data,ks1,ks2,ks3)
DES_LONG *data;
des_key_schedule ks1;
des_key_schedule ks2;
des_key_schedule ks3;
{
register DES_LONG l,r;
l=data[0];
r=data[1];
IP(l,r);
data[0]=l;
data[1]=r;
des_encrypt2((DES_LONG *)data,ks1,DES_ENCRYPT);
des_encrypt2((DES_LONG *)data,ks2,DES_DECRYPT);
des_encrypt2((DES_LONG *)data,ks3,DES_ENCRYPT);
l=data[0];
r=data[1];
FP(r,l);
data[0]=l;
data[1]=r;
}
void des_decrypt3(data,ks1,ks2,ks3)
DES_LONG *data;
des_key_schedule ks1;
des_key_schedule ks2;
des_key_schedule ks3;
{
register DES_LONG l,r;
l=data[0];
r=data[1];
IP(l,r);
data[0]=l;
data[1]=r;
des_encrypt2((DES_LONG *)data,ks3,DES_DECRYPT);
des_encrypt2((DES_LONG *)data,ks2,DES_ENCRYPT);
des_encrypt2((DES_LONG *)data,ks1,DES_DECRYPT);
l=data[0];
r=data[1];
FP(r,l);
data[0]=l;
data[1]=r;
}
#ifndef DES_DEFAULT_OPTIONS
void des_ncbc_encrypt(input, output, length, schedule, ivec, enc)
des_cblock (*input);
des_cblock (*output);
long length;
des_key_schedule schedule;
des_cblock (*ivec);
int enc;
{
register DES_LONG tin0,tin1;
register DES_LONG tout0,tout1,xor0,xor1;
register unsigned char *in,*out;
register long l=length;
DES_LONG tin[2];
unsigned char *iv;
in=(unsigned char *)input;
out=(unsigned char *)output;
iv=(unsigned char *)ivec;
if (enc)
{
c2l(iv,tout0);
c2l(iv,tout1);
for (l-=8; l>=0; l-=8)
{
c2l(in,tin0);
c2l(in,tin1);
tin0^=tout0; tin[0]=tin0;
tin1^=tout1; tin[1]=tin1;
des_encrypt((DES_LONG *)tin,schedule,DES_ENCRYPT);
tout0=tin[0]; l2c(tout0,out);
tout1=tin[1]; l2c(tout1,out);
}
if (l != -8)
{
c2ln(in,tin0,tin1,l+8);
tin0^=tout0; tin[0]=tin0;
tin1^=tout1; tin[1]=tin1;
des_encrypt((DES_LONG *)tin,schedule,DES_ENCRYPT);
tout0=tin[0]; l2c(tout0,out);
tout1=tin[1]; l2c(tout1,out);
}
iv=(unsigned char *)ivec;
l2c(tout0,iv);
l2c(tout1,iv);
}
else
{
c2l(iv,xor0);
c2l(iv,xor1);
for (l-=8; l>=0; l-=8)
{
c2l(in,tin0); tin[0]=tin0;
c2l(in,tin1); tin[1]=tin1;
des_encrypt((DES_LONG *)tin,schedule,DES_DECRYPT);
tout0=tin[0]^xor0;
tout1=tin[1]^xor1;
l2c(tout0,out);
l2c(tout1,out);
xor0=tin0;
xor1=tin1;
}
if (l != -8)
{
c2l(in,tin0); tin[0]=tin0;
c2l(in,tin1); tin[1]=tin1;
des_encrypt((DES_LONG *)tin,schedule,DES_DECRYPT);
tout0=tin[0]^xor0;
tout1=tin[1]^xor1;
l2cn(tout0,tout1,out,l+8);
xor0=tin0;
xor1=tin1;
}
iv=(unsigned char *)ivec;
l2c(xor0,iv);
l2c(xor1,iv);
}
tin0=tin1=tout0=tout1=xor0=xor1=0;
tin[0]=tin[1]=0;
}
void des_ede3_cbc_encrypt(input, output, length, ks1, ks2, ks3, ivec, enc)
des_cblock (*input);
des_cblock (*output);
long length;
des_key_schedule ks1;
des_key_schedule ks2;
des_key_schedule ks3;
des_cblock (*ivec);
int enc;
{
register DES_LONG tin0,tin1;
register DES_LONG tout0,tout1,xor0,xor1;
register unsigned char *in,*out;
register long l=length;
DES_LONG tin[2];
unsigned char *iv;
in=(unsigned char *)input;
out=(unsigned char *)output;
iv=(unsigned char *)ivec;
if (enc)
{
c2l(iv,tout0);
c2l(iv,tout1);
for (l-=8; l>=0; l-=8)
{
c2l(in,tin0);
c2l(in,tin1);
tin0^=tout0;
tin1^=tout1;
tin[0]=tin0;
tin[1]=tin1;
des_encrypt3((DES_LONG *)tin,ks1,ks2,ks3);
tout0=tin[0];
tout1=tin[1];
l2c(tout0,out);
l2c(tout1,out);
}
if (l != -8)
{
c2ln(in,tin0,tin1,l+8);
tin0^=tout0;
tin1^=tout1;
tin[0]=tin0;
tin[1]=tin1;
des_encrypt3((DES_LONG *)tin,ks1,ks2,ks3);
tout0=tin[0];
tout1=tin[1];
l2c(tout0,out);
l2c(tout1,out);
}
iv=(unsigned char *)ivec;
l2c(tout0,iv);
l2c(tout1,iv);
}
else
{
register DES_LONG t0,t1;
c2l(iv,xor0);
c2l(iv,xor1);
for (l-=8; l>=0; l-=8)
{
c2l(in,tin0);
c2l(in,tin1);
t0=tin0;
t1=tin1;
tin[0]=tin0;
tin[1]=tin1;
des_decrypt3((DES_LONG *)tin,ks1,ks2,ks3);
tout0=tin[0];
tout1=tin[1];
tout0^=xor0;
tout1^=xor1;
l2c(tout0,out);
l2c(tout1,out);
xor0=t0;
xor1=t1;
}
if (l != -8)
{
c2l(in,tin0);
c2l(in,tin1);
t0=tin0;
t1=tin1;
tin[0]=tin0;
tin[1]=tin1;
des_decrypt3((DES_LONG *)tin,ks1,ks2,ks3);
tout0=tin[0];
tout1=tin[1];
tout0^=xor0;
tout1^=xor1;
l2cn(tout0,tout1,out,l+8);
xor0=t0;
xor1=t1;
}
iv=(unsigned char *)ivec;
l2c(xor0,iv);
l2c(xor1,iv);
}
tin0=tin1=tout0=tout1=xor0=xor1=0;
tin[0]=tin[1]=0;
}
#endif /* DES_DEFAULT_OPTIONS */
linux/crypto/ciphers/des/des_locl.h
+515
View File
@@ -0,0 +1,515 @@
/* crypto/des/des_locl.org */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
*
* Always modify des_locl.org since des_locl.h is automatically generated from
* it during SSLeay configuration.
*
* WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
*/
#ifndef HEADER_DES_LOCL_H
#define HEADER_DES_LOCL_H
#if defined(WIN32) || defined(WIN16)
#ifndef MSDOS
#define MSDOS
#endif
#endif
#include "crypto/des.h"
#ifndef DES_DEFAULT_OPTIONS
/* the following is tweaked from a config script, that is why it is a
* protected undef/define */
#ifndef DES_PTR
#define DES_PTR
#endif
/* This helps C compiler generate the correct code for multiple functional
* units. It reduces register dependancies at the expense of 2 more
* registers */
#ifndef DES_RISC1
#define DES_RISC1
#endif
#ifndef DES_RISC2
#undef DES_RISC2
#endif
#if defined(DES_RISC1) && defined(DES_RISC2)
YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
#endif
/* Unroll the inner loop, this sometimes helps, sometimes hinders.
* Very mucy CPU dependant */
#ifndef DES_UNROLL
#define DES_UNROLL
#endif
/* These default values were supplied by
* Peter Gutman <[email protected]>
* They are only used if nothing else has been defined */
#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL)
/* Special defines which change the way the code is built depending on the
CPU and OS. For SGI machines you can use _MIPS_SZLONG (32 or 64) to find
even newer MIPS CPU's, but at the moment one size fits all for
optimization options. Older Sparc's work better with only UNROLL, but
there's no way to tell at compile time what it is you're running on */
#if defined( sun ) /* Newer Sparc's */
#define DES_PTR
#define DES_RISC1
#define DES_UNROLL
#elif defined( __ultrix ) /* Older MIPS */
#define DES_PTR
#define DES_RISC2
#define DES_UNROLL
#elif defined( __osf1__ ) /* Alpha */
#define DES_PTR
#define DES_RISC2
#elif defined ( _AIX ) /* RS6000 */
/* Unknown */
#elif defined( __hpux ) /* HP-PA */
/* Unknown */
#elif defined( __aux ) /* 68K */
/* Unknown */
#elif defined( __dgux ) /* 88K (but P6 in latest boxes) */
#define DES_UNROLL
#elif defined( __sgi ) /* Newer MIPS */
#define DES_PTR
#define DES_RISC2
#define DES_UNROLL
#elif defined( i386 ) /* x86 boxes, should be gcc */
#define DES_PTR
#define DES_RISC1
#define DES_UNROLL
#endif /* Systems-specific speed defines */
#endif
#endif /* DES_DEFAULT_OPTIONS */
#ifdef MSDOS /* Visual C++ 2.1 (Windows NT/95) */
#include <stdlib.h>
#include <errno.h>
#include <time.h>
#include <io.h>
#ifndef RAND
#define RAND
#endif
#undef NOPROTO
#endif
#if defined(__STDC__) || defined(VMS) || defined(M_XENIX) || defined(MSDOS)
#ifndef __KERNEL__
#include <string.h>
#else
#include <linux/string.h>
#endif
#endif
#ifndef RAND
#define RAND
#endif
#ifdef linux
#undef RAND
#endif
#ifdef MSDOS
#define getpid() 2
#define RAND
#undef NOPROTO
#endif
#if defined(NOCONST)
#define const
#endif
#ifdef __STDC__
#undef NOPROTO
#endif
#ifdef RAND
#define srandom(s) srand(s)
#define random rand
#endif
#define ITERATIONS 16
#define HALF_ITERATIONS 8
/* used in des_read and des_write */
#define MAXWRITE (1024*16)
#define BSIZE (MAXWRITE+4)
#define c2l(c,l) (l =((DES_LONG)(*((c)++))) , \
l|=((DES_LONG)(*((c)++)))<< 8L, \
l|=((DES_LONG)(*((c)++)))<<16L, \
l|=((DES_LONG)(*((c)++)))<<24L)
/* NOTE - c is not incremented as per c2l */
#define c2ln(c,l1,l2,n) { \
c+=n; \
l1=l2=0; \
switch (n) { \
case 8: l2 =((DES_LONG)(*(--(c))))<<24L; \
case 7: l2|=((DES_LONG)(*(--(c))))<<16L; \
case 6: l2|=((DES_LONG)(*(--(c))))<< 8L; \
case 5: l2|=((DES_LONG)(*(--(c)))); \
case 4: l1 =((DES_LONG)(*(--(c))))<<24L; \
case 3: l1|=((DES_LONG)(*(--(c))))<<16L; \
case 2: l1|=((DES_LONG)(*(--(c))))<< 8L; \
case 1: l1|=((DES_LONG)(*(--(c)))); \
} \
}
#define l2c(l,c) (*((c)++)=(unsigned char)(((l) )&0xff), \
*((c)++)=(unsigned char)(((l)>> 8L)&0xff), \
*((c)++)=(unsigned char)(((l)>>16L)&0xff), \
*((c)++)=(unsigned char)(((l)>>24L)&0xff))
/* replacements for htonl and ntohl since I have no idea what to do
* when faced with machines with 8 byte longs. */
#define HDRSIZE 4
#define n2l(c,l) (l =((DES_LONG)(*((c)++)))<<24L, \
l|=((DES_LONG)(*((c)++)))<<16L, \
l|=((DES_LONG)(*((c)++)))<< 8L, \
l|=((DES_LONG)(*((c)++))))
#define l2n(l,c) (*((c)++)=(unsigned char)(((l)>>24L)&0xff), \
*((c)++)=(unsigned char)(((l)>>16L)&0xff), \
*((c)++)=(unsigned char)(((l)>> 8L)&0xff), \
*((c)++)=(unsigned char)(((l) )&0xff))
/* NOTE - c is not incremented as per l2c */
#define l2cn(l1,l2,c,n) { \
c+=n; \
switch (n) { \
case 8: *(--(c))=(unsigned char)(((l2)>>24L)&0xff); \
case 7: *(--(c))=(unsigned char)(((l2)>>16L)&0xff); \
case 6: *(--(c))=(unsigned char)(((l2)>> 8L)&0xff); \
case 5: *(--(c))=(unsigned char)(((l2) )&0xff); \
case 4: *(--(c))=(unsigned char)(((l1)>>24L)&0xff); \
case 3: *(--(c))=(unsigned char)(((l1)>>16L)&0xff); \
case 2: *(--(c))=(unsigned char)(((l1)>> 8L)&0xff); \
case 1: *(--(c))=(unsigned char)(((l1) )&0xff); \
} \
}
#if defined(WIN32)
#define ROTATE(a,n) (_lrotr(a,n))
#else
#define ROTATE(a,n) (((a)>>(n))+((a)<<(32-(n))))
#endif
/* Don't worry about the LOAD_DATA() stuff, that is used by
* fcrypt() to add it's little bit to the front */
#ifdef DES_FCRYPT
#define LOAD_DATA_tmp(R,S,u,t,E0,E1) \
{ DES_LONG tmp; LOAD_DATA(R,S,u,t,E0,E1,tmp); }
#define LOAD_DATA(R,S,u,t,E0,E1,tmp) \
t=R^(R>>16L); \
u=t&E0; t&=E1; \
tmp=(u<<16); u^=R^s[S ]; u^=tmp; \
tmp=(t<<16); t^=R^s[S+1]; t^=tmp
#else
#define LOAD_DATA_tmp(a,b,c,d,e,f) LOAD_DATA(a,b,c,d,e,f,g)
#define LOAD_DATA(R,S,u,t,E0,E1,tmp) \
u=R^s[S ]; \
t=R^s[S+1]
#endif
/* The changes to this macro may help or hinder, depending on the
* compiler and the achitecture. gcc2 always seems to do well :-).
* Inspired by Dana How <[email protected]>
* DO NOT use the alternative version on machines with 8 byte longs.
* It does not seem to work on the Alpha, even when DES_LONG is 4
* bytes, probably an issue of accessing non-word aligned objects :-( */
#ifdef DES_PTR
/* It recently occured to me that 0^0^0^0^0^0^0 == 0, so there
* is no reason to not xor all the sub items together. This potentially
* saves a register since things can be xored directly into L */
#if defined(DES_RISC1) || defined(DES_RISC2)
#ifdef DES_RISC1
#define D_ENCRYPT(LL,R,S) { \
unsigned int u1,u2,u3; \
LOAD_DATA(R,S,u,t,E0,E1,u1); \
u2=(int)u>>8L; \
u1=(int)u&0xfc; \
u2&=0xfc; \
t=ROTATE(t,4); \
u>>=16L; \
LL^= *(DES_LONG *)((unsigned char *)des_SP +u1); \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x200+u2); \
u3=(int)(u>>8L); \
u1=(int)u&0xfc; \
u3&=0xfc; \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x400+u1); \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x600+u3); \
u2=(int)t>>8L; \
u1=(int)t&0xfc; \
u2&=0xfc; \
t>>=16L; \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x100+u1); \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x300+u2); \
u3=(int)t>>8L; \
u1=(int)t&0xfc; \
u3&=0xfc; \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x500+u1); \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x700+u3); }
#endif
#ifdef DES_RISC2
#define D_ENCRYPT(LL,R,S) { \
unsigned int u1,u2,s1,s2; \
LOAD_DATA(R,S,u,t,E0,E1,u1); \
u2=(int)u>>8L; \
u1=(int)u&0xfc; \
u2&=0xfc; \
t=ROTATE(t,4); \
LL^= *(DES_LONG *)((unsigned char *)des_SP +u1); \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x200+u2); \
s1=(int)(u>>16L); \
s2=(int)(u>>24L); \
s1&=0xfc; \
s2&=0xfc; \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x400+s1); \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x600+s2); \
u2=(int)t>>8L; \
u1=(int)t&0xfc; \
u2&=0xfc; \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x100+u1); \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x300+u2); \
s1=(int)(t>>16L); \
s2=(int)(t>>24L); \
s1&=0xfc; \
s2&=0xfc; \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x500+s1); \
LL^= *(DES_LONG *)((unsigned char *)des_SP+0x700+s2); }
#endif
#else
#define D_ENCRYPT(LL,R,S) { \
LOAD_DATA_tmp(R,S,u,t,E0,E1); \
t=ROTATE(t,4); \
LL^= \
*(DES_LONG *)((unsigned char *)des_SP +((u )&0xfc))^ \
*(DES_LONG *)((unsigned char *)des_SP+0x200+((u>> 8L)&0xfc))^ \
*(DES_LONG *)((unsigned char *)des_SP+0x400+((u>>16L)&0xfc))^ \
*(DES_LONG *)((unsigned char *)des_SP+0x600+((u>>24L)&0xfc))^ \
*(DES_LONG *)((unsigned char *)des_SP+0x100+((t )&0xfc))^ \
*(DES_LONG *)((unsigned char *)des_SP+0x300+((t>> 8L)&0xfc))^ \
*(DES_LONG *)((unsigned char *)des_SP+0x500+((t>>16L)&0xfc))^ \
*(DES_LONG *)((unsigned char *)des_SP+0x700+((t>>24L)&0xfc)); }
#endif
#else /* original version */
#if defined(DES_RISC1) || defined(DES_RISC2)
#ifdef DES_RISC1
#define D_ENCRYPT(LL,R,S) {\
unsigned int u1,u2,u3; \
LOAD_DATA(R,S,u,t,E0,E1,u1); \
u>>=2L; \
t=ROTATE(t,6); \
u2=(int)u>>8L; \
u1=(int)u&0x3f; \
u2&=0x3f; \
u>>=16L; \
LL^=des_SPtrans[0][u1]; \
LL^=des_SPtrans[2][u2]; \
u3=(int)u>>8L; \
u1=(int)u&0x3f; \
u3&=0x3f; \
LL^=des_SPtrans[4][u1]; \
LL^=des_SPtrans[6][u3]; \
u2=(int)t>>8L; \
u1=(int)t&0x3f; \
u2&=0x3f; \
t>>=16L; \
LL^=des_SPtrans[1][u1]; \
LL^=des_SPtrans[3][u2]; \
u3=(int)t>>8L; \
u1=(int)t&0x3f; \
u3&=0x3f; \
LL^=des_SPtrans[5][u1]; \
LL^=des_SPtrans[7][u3]; }
#endif
#ifdef DES_RISC2
#define D_ENCRYPT(LL,R,S) {\
unsigned int u1,u2,s1,s2; \
LOAD_DATA(R,S,u,t,E0,E1,u1); \
u>>=2L; \
t=ROTATE(t,6); \
u2=(int)u>>8L; \
u1=(int)u&0x3f; \
u2&=0x3f; \
LL^=des_SPtrans[0][u1]; \
LL^=des_SPtrans[2][u2]; \
s1=(int)u>>16L; \
s2=(int)u>>24L; \
s1&=0x3f; \
s2&=0x3f; \
LL^=des_SPtrans[4][s1]; \
LL^=des_SPtrans[6][s2]; \
u2=(int)t>>8L; \
u1=(int)t&0x3f; \
u2&=0x3f; \
LL^=des_SPtrans[1][u1]; \
LL^=des_SPtrans[3][u2]; \
s1=(int)t>>16; \
s2=(int)t>>24L; \
s1&=0x3f; \
s2&=0x3f; \
LL^=des_SPtrans[5][s1]; \
LL^=des_SPtrans[7][s2]; }
#endif
#else
#define D_ENCRYPT(LL,R,S) {\
LOAD_DATA_tmp(R,S,u,t,E0,E1); \
t=ROTATE(t,4); \
LL^=\
des_SPtrans[0][(u>> 2L)&0x3f]^ \
des_SPtrans[2][(u>>10L)&0x3f]^ \
des_SPtrans[4][(u>>18L)&0x3f]^ \
des_SPtrans[6][(u>>26L)&0x3f]^ \
des_SPtrans[1][(t>> 2L)&0x3f]^ \
des_SPtrans[3][(t>>10L)&0x3f]^ \
des_SPtrans[5][(t>>18L)&0x3f]^ \
des_SPtrans[7][(t>>26L)&0x3f]; }
#endif
#endif
/* IP and FP
* The problem is more of a geometric problem that random bit fiddling.
0 1 2 3 4 5 6 7 62 54 46 38 30 22 14 6
8 9 10 11 12 13 14 15 60 52 44 36 28 20 12 4
16 17 18 19 20 21 22 23 58 50 42 34 26 18 10 2
24 25 26 27 28 29 30 31 to 56 48 40 32 24 16 8 0
32 33 34 35 36 37 38 39 63 55 47 39 31 23 15 7
40 41 42 43 44 45 46 47 61 53 45 37 29 21 13 5
48 49 50 51 52 53 54 55 59 51 43 35 27 19 11 3
56 57 58 59 60 61 62 63 57 49 41 33 25 17 9 1
The output has been subject to swaps of the form
0 1 -> 3 1 but the odd and even bits have been put into
2 3 2 0
different words. The main trick is to remember that
t=((l>>size)^r)&(mask);
r^=t;
l^=(t<<size);
can be used to swap and move bits between words.
So l = 0 1 2 3 r = 16 17 18 19
4 5 6 7 20 21 22 23
8 9 10 11 24 25 26 27
12 13 14 15 28 29 30 31
becomes (for size == 2 and mask == 0x3333)
t = 2^16 3^17 -- -- l = 0 1 16 17 r = 2 3 18 19
6^20 7^21 -- -- 4 5 20 21 6 7 22 23
10^24 11^25 -- -- 8 9 24 25 10 11 24 25
14^28 15^29 -- -- 12 13 28 29 14 15 28 29
Thanks for hints from Richard Outerbridge - he told me IP&FP
could be done in 15 xor, 10 shifts and 5 ands.
When I finally started to think of the problem in 2D
I first got ~42 operations without xors. When I remembered
how to use xors :-) I got it to its final state.
*/
#define PERM_OP(a,b,t,n,m) ((t)=((((a)>>(n))^(b))&(m)),\
(b)^=(t),\
(a)^=((t)<<(n)))
#define IP(l,r) \
{ \
register DES_LONG tt; \
PERM_OP(r,l,tt, 4,0x0f0f0f0fL); \
PERM_OP(l,r,tt,16,0x0000ffffL); \
PERM_OP(r,l,tt, 2,0x33333333L); \
PERM_OP(l,r,tt, 8,0x00ff00ffL); \
PERM_OP(r,l,tt, 1,0x55555555L); \
}
#define FP(l,r) \
{ \
register DES_LONG tt; \
PERM_OP(l,r,tt, 1,0x55555555L); \
PERM_OP(r,l,tt, 8,0x00ff00ffL); \
PERM_OP(l,r,tt, 2,0x33333333L); \
PERM_OP(r,l,tt,16,0x0000ffffL); \
PERM_OP(l,r,tt, 4,0x0f0f0f0fL); \
}
extern const DES_LONG des_SPtrans[8][64];
#ifndef NOPROTO
void fcrypt_body(DES_LONG *out,des_key_schedule ks,
DES_LONG Eswap0, DES_LONG Eswap1);
#else
void fcrypt_body();
#endif
#endif
linux/crypto/ciphers/des/des_opts.c
+620
View File
@@ -0,0 +1,620 @@
/* crypto/des/des_opts.c */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* define PART1, PART2, PART3 or PART4 to build only with a few of the options.
* This is for machines with 64k code segment size restrictions. */
#ifndef MSDOS
#define TIMES
#endif
#include <stdio.h>
#ifndef MSDOS
#include <unistd.h>
#else
#include <io.h>
extern void exit();
#endif
#include <signal.h>
#ifndef VMS
#ifndef _IRIX
#include <time.h>
#endif
#ifdef TIMES
#include <sys/types.h>
#include <sys/times.h>
#endif
#else /* VMS */
#include <types.h>
struct tms {
time_t tms_utime;
time_t tms_stime;
time_t tms_uchild; /* I dunno... */
time_t tms_uchildsys; /* so these names are a guess :-) */
}
#endif
#ifndef TIMES
#include <sys/timeb.h>
#endif
#ifdef sun
#include <limits.h>
#include <sys/param.h>
#endif
#include "des_locl.h"
#include "spr.h"
#define DES_DEFAULT_OPTIONS
#if !defined(PART1) && !defined(PART2) && !defined(PART3) && !defined(PART4)
#define PART1
#define PART2
#define PART3
#define PART4
#endif
#ifdef PART1
#undef DES_UNROLL
#undef DES_RISC1
#undef DES_RISC2
#undef DES_PTR
#undef D_ENCRYPT
#define des_encrypt des_encrypt_u4_cisc_idx
#define des_encrypt2 des_encrypt2_u4_cisc_idx
#define des_encrypt3 des_encrypt3_u4_cisc_idx
#define des_decrypt3 des_decrypt3_u4_cisc_idx
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#define DES_UNROLL
#undef DES_RISC1
#undef DES_RISC2
#undef DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u16_cisc_idx
#define des_encrypt2 des_encrypt2_u16_cisc_idx
#define des_encrypt3 des_encrypt3_u16_cisc_idx
#define des_decrypt3 des_decrypt3_u16_cisc_idx
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#undef DES_UNROLL
#define DES_RISC1
#undef DES_RISC2
#undef DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u4_risc1_idx
#define des_encrypt2 des_encrypt2_u4_risc1_idx
#define des_encrypt3 des_encrypt3_u4_risc1_idx
#define des_decrypt3 des_decrypt3_u4_risc1_idx
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#endif
#ifdef PART2
#undef DES_UNROLL
#undef DES_RISC1
#define DES_RISC2
#undef DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u4_risc2_idx
#define des_encrypt2 des_encrypt2_u4_risc2_idx
#define des_encrypt3 des_encrypt3_u4_risc2_idx
#define des_decrypt3 des_decrypt3_u4_risc2_idx
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#define DES_UNROLL
#define DES_RISC1
#undef DES_RISC2
#undef DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u16_risc1_idx
#define des_encrypt2 des_encrypt2_u16_risc1_idx
#define des_encrypt3 des_encrypt3_u16_risc1_idx
#define des_decrypt3 des_decrypt3_u16_risc1_idx
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#define DES_UNROLL
#undef DES_RISC1
#define DES_RISC2
#undef DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u16_risc2_idx
#define des_encrypt2 des_encrypt2_u16_risc2_idx
#define des_encrypt3 des_encrypt3_u16_risc2_idx
#define des_decrypt3 des_decrypt3_u16_risc2_idx
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#endif
#ifdef PART3
#undef DES_UNROLL
#undef DES_RISC1
#undef DES_RISC2
#define DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u4_cisc_ptr
#define des_encrypt2 des_encrypt2_u4_cisc_ptr
#define des_encrypt3 des_encrypt3_u4_cisc_ptr
#define des_decrypt3 des_decrypt3_u4_cisc_ptr
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#define DES_UNROLL
#undef DES_RISC1
#undef DES_RISC2
#define DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u16_cisc_ptr
#define des_encrypt2 des_encrypt2_u16_cisc_ptr
#define des_encrypt3 des_encrypt3_u16_cisc_ptr
#define des_decrypt3 des_decrypt3_u16_cisc_ptr
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#undef DES_UNROLL
#define DES_RISC1
#undef DES_RISC2
#define DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u4_risc1_ptr
#define des_encrypt2 des_encrypt2_u4_risc1_ptr
#define des_encrypt3 des_encrypt3_u4_risc1_ptr
#define des_decrypt3 des_decrypt3_u4_risc1_ptr
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#endif
#ifdef PART4
#undef DES_UNROLL
#undef DES_RISC1
#define DES_RISC2
#define DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u4_risc2_ptr
#define des_encrypt2 des_encrypt2_u4_risc2_ptr
#define des_encrypt3 des_encrypt3_u4_risc2_ptr
#define des_decrypt3 des_decrypt3_u4_risc2_ptr
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#define DES_UNROLL
#define DES_RISC1
#undef DES_RISC2
#define DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u16_risc1_ptr
#define des_encrypt2 des_encrypt2_u16_risc1_ptr
#define des_encrypt3 des_encrypt3_u16_risc1_ptr
#define des_decrypt3 des_decrypt3_u16_risc1_ptr
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#define DES_UNROLL
#undef DES_RISC1
#define DES_RISC2
#define DES_PTR
#undef D_ENCRYPT
#undef des_encrypt
#undef des_encrypt2
#undef des_encrypt3
#undef des_decrypt3
#define des_encrypt des_encrypt_u16_risc2_ptr
#define des_encrypt2 des_encrypt2_u16_risc2_ptr
#define des_encrypt3 des_encrypt3_u16_risc2_ptr
#define des_decrypt3 des_decrypt3_u16_risc2_ptr
#undef HEADER_DES_LOCL_H
#include "des_enc.c"
#endif
/* The following if from times(3) man page. It may need to be changed */
#ifndef HZ
# ifndef CLK_TCK
# ifndef _BSD_CLK_TCK_ /* FreeBSD fix */
# ifndef VMS
# define HZ 100.0
# else /* VMS */
# define HZ 100.0
# endif
# else /* _BSD_CLK_TCK_ */
# define HZ ((double)_BSD_CLK_TCK_)
# endif
# else /* CLK_TCK */
# define HZ ((double)CLK_TCK)
# endif
#endif
#define BUFSIZE ((long)1024)
long run=0;
#ifndef NOPROTO
double Time_F(int s);
#else
double Time_F();
#endif
#ifdef SIGALRM
#if defined(__STDC__) || defined(sgi)
#define SIGRETTYPE void
#else
#define SIGRETTYPE int
#endif
#ifndef NOPROTO
SIGRETTYPE sig_done(int sig);
#else
SIGRETTYPE sig_done();
#endif
SIGRETTYPE sig_done(sig)
int sig;
{
signal(SIGALRM,sig_done);
run=0;
#ifdef LINT
sig=sig;
#endif
}
#endif
#define START 0
#define STOP 1
double Time_F(s)
int s;
{
double ret;
#ifdef TIMES
static struct tms tstart,tend;
if (s == START)
{
times(&tstart);
return(0);
}
else
{
times(&tend);
ret=((double)(tend.tms_utime-tstart.tms_utime))/HZ;
return((ret == 0.0)?1e-6:ret);
}
#else /* !times() */
static struct timeb tstart,tend;
long i;
if (s == START)
{
ftime(&tstart);
return(0);
}
else
{
ftime(&tend);
i=(long)tend.millitm-(long)tstart.millitm;
ret=((double)(tend.time-tstart.time))+((double)i)/1000.0;
return((ret == 0.0)?1e-6:ret);
}
#endif
}
#ifdef SIGALRM
#define print_name(name) fprintf(stderr,"Doing %s's for 10 seconds\n",name); alarm(10);
#else
#define print_name(name) fprintf(stderr,"Doing %s %ld times\n",name,cb);
#endif
#define time_it(func,name,index) \
print_name(name); \
Time_F(START); \
for (count=0,run=1; COND(cb); count++) \
{ \
unsigned long d[2]; \
func(d,&(sch[0]),DES_ENCRYPT); \
} \
tm[index]=Time_F(STOP); \
fprintf(stderr,"%ld %s's in %.2f second\n",count,name,tm[index]); \
tm[index]=((double)COUNT(cb))/tm[index];
#define print_it(name,index) \
fprintf(stderr,"%s bytes per sec = %12.2f (%5.1fuS)\n",name, \
tm[index]*8,1.0e6/tm[index]);
int main(argc,argv)
int argc;
char **argv;
{
long count;
static unsigned char buf[BUFSIZE];
static des_cblock key ={0x12,0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0};
static des_cblock key2={0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12};
static des_cblock key3={0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12,0x34};
des_key_schedule sch,sch2,sch3;
double d,tm[16],max=0;
int rank[16];
char *str[16];
int max_idx=0,i,num=0,j;
#ifndef SIGALARM
long ca,cb,cc,cd,ce;
#endif
for (i=0; i<12; i++)
{
tm[i]=0.0;
rank[i]=0;
}
#ifndef TIMES
fprintf(stderr,"To get the most acurate results, try to run this\n");
fprintf(stderr,"program when this computer is idle.\n");
#endif
des_set_key((C_Block *)key,sch);
des_set_key((C_Block *)key2,sch2);
des_set_key((C_Block *)key3,sch3);
#ifndef SIGALRM
fprintf(stderr,"First we calculate the approximate speed ...\n");
des_set_key((C_Block *)key,sch);
count=10;
do {
long i;
unsigned long data[2];
count*=2;
Time_F(START);
for (i=count; i; i--)
des_encrypt(data,&(sch[0]),DES_ENCRYPT);
d=Time_F(STOP);
} while (d < 3.0);
ca=count;
cb=count*3;
cc=count*3*8/BUFSIZE+1;
cd=count*8/BUFSIZE+1;
ce=count/20+1;
#define COND(d) (count != (d))
#define COUNT(d) (d)
#else
#define COND(c) (run)
#define COUNT(d) (count)
signal(SIGALRM,sig_done);
alarm(10);
#endif
#ifdef PART1
time_it(des_encrypt_u4_cisc_idx, "des_encrypt_u4_cisc_idx ", 0);
time_it(des_encrypt_u16_cisc_idx, "des_encrypt_u16_cisc_idx ", 1);
time_it(des_encrypt_u4_risc1_idx, "des_encrypt_u4_risc1_idx ", 2);
num+=3;
#endif
#ifdef PART2
time_it(des_encrypt_u16_risc1_idx,"des_encrypt_u16_risc1_idx", 3);
time_it(des_encrypt_u4_risc2_idx, "des_encrypt_u4_risc2_idx ", 4);
time_it(des_encrypt_u16_risc2_idx,"des_encrypt_u16_risc2_idx", 5);
num+=3;
#endif
#ifdef PART3
time_it(des_encrypt_u4_cisc_ptr, "des_encrypt_u4_cisc_ptr ", 6);
time_it(des_encrypt_u16_cisc_ptr, "des_encrypt_u16_cisc_ptr ", 7);
time_it(des_encrypt_u4_risc1_ptr, "des_encrypt_u4_risc1_ptr ", 8);
num+=3;
#endif
#ifdef PART4
time_it(des_encrypt_u16_risc1_ptr,"des_encrypt_u16_risc1_ptr", 9);
time_it(des_encrypt_u4_risc2_ptr, "des_encrypt_u4_risc2_ptr ",10);
time_it(des_encrypt_u16_risc2_ptr,"des_encrypt_u16_risc2_ptr",11);
num+=3;
#endif
#ifdef PART1
str[0]=" 4 c i";
print_it("des_encrypt_u4_cisc_idx ",0);
max=tm[0];
max_idx=0;
str[1]="16 c i";
print_it("des_encrypt_u16_cisc_idx ",1);
if (max < tm[1]) { max=tm[1]; max_idx=1; }
str[2]=" 4 r1 i";
print_it("des_encrypt_u4_risc1_idx ",2);
if (max < tm[2]) { max=tm[2]; max_idx=2; }
#endif
#ifdef PART2
str[3]="16 r1 i";
print_it("des_encrypt_u16_risc1_idx",3);
if (max < tm[3]) { max=tm[3]; max_idx=3; }
str[4]=" 4 r2 i";
print_it("des_encrypt_u4_risc2_idx ",4);
if (max < tm[4]) { max=tm[4]; max_idx=4; }
str[5]="16 r2 i";
print_it("des_encrypt_u16_risc2_idx",5);
if (max < tm[5]) { max=tm[5]; max_idx=5; }
#endif
#ifdef PART3
str[6]=" 4 c p";
print_it("des_encrypt_u4_cisc_ptr ",6);
if (max < tm[6]) { max=tm[6]; max_idx=6; }
str[7]="16 c p";
print_it("des_encrypt_u16_cisc_ptr ",7);
if (max < tm[7]) { max=tm[7]; max_idx=7; }
str[8]=" 4 r1 p";
print_it("des_encrypt_u4_risc1_ptr ",8);
if (max < tm[8]) { max=tm[8]; max_idx=8; }
#endif
#ifdef PART4
str[9]="16 r1 p";
print_it("des_encrypt_u16_risc1_ptr",9);
if (max < tm[9]) { max=tm[9]; max_idx=9; }
str[10]=" 4 r2 p";
print_it("des_encrypt_u4_risc2_ptr ",10);
if (max < tm[10]) { max=tm[10]; max_idx=10; }
str[11]="16 r2 p";
print_it("des_encrypt_u16_risc2_ptr",11);
if (max < tm[11]) { max=tm[11]; max_idx=11; }
#endif
printf("options des ecb/s\n");
printf("%s %12.2f 100.0%%\n",str[max_idx],tm[max_idx]);
d=tm[max_idx];
tm[max_idx]= -2.0;
max= -1.0;
for (;;)
{
for (i=0; i<12; i++)
{
if (max < tm[i]) { max=tm[i]; j=i; }
}
if (max < 0.0) break;
printf("%s %12.2f %4.1f%%\n",str[j],tm[j],tm[j]/d*100.0);
tm[j]= -2.0;
max= -1.0;
}
switch (max_idx)
{
case 0:
printf("-DDES_DEFAULT_OPTIONS\n");
break;
case 1:
printf("-DDES_UNROLL\n");
break;
case 2:
printf("-DDES_RISC1\n");
break;
case 3:
printf("-DDES_UNROLL -DDES_RISC1\n");
break;
case 4:
printf("-DDES_RISC2\n");
break;
case 5:
printf("-DDES_UNROLL -DDES_RISC2\n");
break;
case 6:
printf("-DDES_PTR\n");
break;
case 7:
printf("-DDES_UNROLL -DDES_PTR\n");
break;
case 8:
printf("-DDES_RISC1 -DDES_PTR\n");
break;
case 9:
printf("-DDES_UNROLL -DDES_RISC1 -DDES_PTR\n");
break;
case 10:
printf("-DDES_RISC2 -DDES_PTR\n");
break;
case 11:
printf("-DDES_UNROLL -DDES_RISC2 -DDES_PTR\n");
break;
}
exit(0);
#if defined(LINT) || defined(MSDOS)
return(0);
#endif
}
linux/crypto/ciphers/des/des_ver.h
+60
View File
@@ -0,0 +1,60 @@
/* crypto/des/des_ver.h */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
extern char *DES_version; /* SSLeay version string */
extern char *libdes_version; /* old libdes version string */
linux/crypto/ciphers/des/destest.c
+871
View File
@@ -0,0 +1,871 @@
/* crypto/des/destest.c */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
#if defined(WIN32) || defined(WIN16) || defined(WINDOWS)
#ifndef MSDOS
#define MSDOS
#endif
#endif
#include <stdio.h>
#include <stdlib.h>
#ifndef MSDOS
#include <unistd.h>
#else
#include <io.h>
#endif
#include <string.h>
#include "des_locl.h"
/* tisk tisk - the test keys don't all have odd parity :-( */
/* test data */
#define NUM_TESTS 34
static unsigned char key_data[NUM_TESTS][8]={
{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
{0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},
{0x30,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
{0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11},
{0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF},
{0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11},
{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
{0xFE,0xDC,0xBA,0x98,0x76,0x54,0x32,0x10},
{0x7C,0xA1,0x10,0x45,0x4A,0x1A,0x6E,0x57},
{0x01,0x31,0xD9,0x61,0x9D,0xC1,0x37,0x6E},
{0x07,0xA1,0x13,0x3E,0x4A,0x0B,0x26,0x86},
{0x38,0x49,0x67,0x4C,0x26,0x02,0x31,0x9E},
{0x04,0xB9,0x15,0xBA,0x43,0xFE,0xB5,0xB6},
{0x01,0x13,0xB9,0x70,0xFD,0x34,0xF2,0xCE},
{0x01,0x70,0xF1,0x75,0x46,0x8F,0xB5,0xE6},
{0x43,0x29,0x7F,0xAD,0x38,0xE3,0x73,0xFE},
{0x07,0xA7,0x13,0x70,0x45,0xDA,0x2A,0x16},
{0x04,0x68,0x91,0x04,0xC2,0xFD,0x3B,0x2F},
{0x37,0xD0,0x6B,0xB5,0x16,0xCB,0x75,0x46},
{0x1F,0x08,0x26,0x0D,0x1A,0xC2,0x46,0x5E},
{0x58,0x40,0x23,0x64,0x1A,0xBA,0x61,0x76},
{0x02,0x58,0x16,0x16,0x46,0x29,0xB0,0x07},
{0x49,0x79,0x3E,0xBC,0x79,0xB3,0x25,0x8F},
{0x4F,0xB0,0x5E,0x15,0x15,0xAB,0x73,0xA7},
{0x49,0xE9,0x5D,0x6D,0x4C,0xA2,0x29,0xBF},
{0x01,0x83,0x10,0xDC,0x40,0x9B,0x26,0xD6},
{0x1C,0x58,0x7F,0x1C,0x13,0x92,0x4F,0xEF},
{0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01},
{0x1F,0x1F,0x1F,0x1F,0x0E,0x0E,0x0E,0x0E},
{0xE0,0xFE,0xE0,0xFE,0xF1,0xFE,0xF1,0xFE},
{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
{0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},
{0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF},
{0xFE,0xDC,0xBA,0x98,0x76,0x54,0x32,0x10}};
static unsigned char plain_data[NUM_TESTS][8]={
{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
{0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},
{0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x01},
{0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11},
{0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11},
{0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF},
{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
{0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF},
{0x01,0xA1,0xD6,0xD0,0x39,0x77,0x67,0x42},
{0x5C,0xD5,0x4C,0xA8,0x3D,0xEF,0x57,0xDA},
{0x02,0x48,0xD4,0x38,0x06,0xF6,0x71,0x72},
{0x51,0x45,0x4B,0x58,0x2D,0xDF,0x44,0x0A},
{0x42,0xFD,0x44,0x30,0x59,0x57,0x7F,0xA2},
{0x05,0x9B,0x5E,0x08,0x51,0xCF,0x14,0x3A},
{0x07,0x56,0xD8,0xE0,0x77,0x47,0x61,0xD2},
{0x76,0x25,0x14,0xB8,0x29,0xBF,0x48,0x6A},
{0x3B,0xDD,0x11,0x90,0x49,0x37,0x28,0x02},
{0x26,0x95,0x5F,0x68,0x35,0xAF,0x60,0x9A},
{0x16,0x4D,0x5E,0x40,0x4F,0x27,0x52,0x32},
{0x6B,0x05,0x6E,0x18,0x75,0x9F,0x5C,0xCA},
{0x00,0x4B,0xD6,0xEF,0x09,0x17,0x60,0x62},
{0x48,0x0D,0x39,0x00,0x6E,0xE7,0x62,0xF2},
{0x43,0x75,0x40,0xC8,0x69,0x8F,0x3C,0xFA},
{0x07,0x2D,0x43,0xA0,0x77,0x07,0x52,0x92},
{0x02,0xFE,0x55,0x77,0x81,0x17,0xF1,0x2A},
{0x1D,0x9D,0x5C,0x50,0x18,0xF7,0x28,0xC2},
{0x30,0x55,0x32,0x28,0x6D,0x6F,0x29,0x5A},
{0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF},
{0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF},
{0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF},
{0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},
{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},
{0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}};
static unsigned char cipher_data[NUM_TESTS][8]={
{0x8C,0xA6,0x4D,0xE9,0xC1,0xB1,0x23,0xA7},
{0x73,0x59,0xB2,0x16,0x3E,0x4E,0xDC,0x58},
{0x95,0x8E,0x6E,0x62,0x7A,0x05,0x55,0x7B},
{0xF4,0x03,0x79,0xAB,0x9E,0x0E,0xC5,0x33},
{0x17,0x66,0x8D,0xFC,0x72,0x92,0x53,0x2D},
{0x8A,0x5A,0xE1,0xF8,0x1A,0xB8,0xF2,0xDD},
{0x8C,0xA6,0x4D,0xE9,0xC1,0xB1,0x23,0xA7},
{0xED,0x39,0xD9,0x50,0xFA,0x74,0xBC,0xC4},
{0x69,0x0F,0x5B,0x0D,0x9A,0x26,0x93,0x9B},
{0x7A,0x38,0x9D,0x10,0x35,0x4B,0xD2,0x71},
{0x86,0x8E,0xBB,0x51,0xCA,0xB4,0x59,0x9A},
{0x71,0x78,0x87,0x6E,0x01,0xF1,0x9B,0x2A},
{0xAF,0x37,0xFB,0x42,0x1F,0x8C,0x40,0x95},
{0x86,0xA5,0x60,0xF1,0x0E,0xC6,0xD8,0x5B},
{0x0C,0xD3,0xDA,0x02,0x00,0x21,0xDC,0x09},
{0xEA,0x67,0x6B,0x2C,0xB7,0xDB,0x2B,0x7A},
{0xDF,0xD6,0x4A,0x81,0x5C,0xAF,0x1A,0x0F},
{0x5C,0x51,0x3C,0x9C,0x48,0x86,0xC0,0x88},
{0x0A,0x2A,0xEE,0xAE,0x3F,0xF4,0xAB,0x77},
{0xEF,0x1B,0xF0,0x3E,0x5D,0xFA,0x57,0x5A},
{0x88,0xBF,0x0D,0xB6,0xD7,0x0D,0xEE,0x56},
{0xA1,0xF9,0x91,0x55,0x41,0x02,0x0B,0x56},
{0x6F,0xBF,0x1C,0xAF,0xCF,0xFD,0x05,0x56},
{0x2F,0x22,0xE4,0x9B,0xAB,0x7C,0xA1,0xAC},
{0x5A,0x6B,0x61,0x2C,0xC2,0x6C,0xCE,0x4A},
{0x5F,0x4C,0x03,0x8E,0xD1,0x2B,0x2E,0x41},
{0x63,0xFA,0xC0,0xD0,0x34,0xD9,0xF7,0x93},
{0x61,0x7B,0x3A,0x0C,0xE8,0xF0,0x71,0x00},
{0xDB,0x95,0x86,0x05,0xF8,0xC8,0xC6,0x06},
{0xED,0xBF,0xD1,0xC6,0x6C,0x29,0xCC,0xC7},
{0x35,0x55,0x50,0xB2,0x15,0x0E,0x24,0x51},
{0xCA,0xAA,0xAF,0x4D,0xEA,0xF1,0xDB,0xAE},
{0xD5,0xD4,0x4F,0xF7,0x20,0x68,0x3D,0x0D},
{0x2A,0x2B,0xB0,0x08,0xDF,0x97,0xC2,0xF2}};
static unsigned char cipher_ecb2[NUM_TESTS-1][8]={
{0x92,0x95,0xB5,0x9B,0xB3,0x84,0x73,0x6E},
{0x19,0x9E,0x9D,0x6D,0xF3,0x9A,0xA8,0x16},
{0x2A,0x4B,0x4D,0x24,0x52,0x43,0x84,0x27},
{0x35,0x84,0x3C,0x01,0x9D,0x18,0xC5,0xB6},
{0x4A,0x5B,0x2F,0x42,0xAA,0x77,0x19,0x25},
{0xA0,0x6B,0xA9,0xB8,0xCA,0x5B,0x17,0x8A},
{0xAB,0x9D,0xB7,0xFB,0xED,0x95,0xF2,0x74},
{0x3D,0x25,0x6C,0x23,0xA7,0x25,0x2F,0xD6},
{0xB7,0x6F,0xAB,0x4F,0xBD,0xBD,0xB7,0x67},
{0x8F,0x68,0x27,0xD6,0x9C,0xF4,0x1A,0x10},
{0x82,0x57,0xA1,0xD6,0x50,0x5E,0x81,0x85},
{0xA2,0x0F,0x0A,0xCD,0x80,0x89,0x7D,0xFA},
{0xCD,0x2A,0x53,0x3A,0xDB,0x0D,0x7E,0xF3},
{0xD2,0xC2,0xBE,0x27,0xE8,0x1B,0x68,0xE3},
{0xE9,0x24,0xCF,0x4F,0x89,0x3C,0x5B,0x0A},
{0xA7,0x18,0xC3,0x9F,0xFA,0x9F,0xD7,0x69},
{0x77,0x2C,0x79,0xB1,0xD2,0x31,0x7E,0xB1},
{0x49,0xAB,0x92,0x7F,0xD0,0x22,0x00,0xB7},
{0xCE,0x1C,0x6C,0x7D,0x85,0xE3,0x4A,0x6F},
{0xBE,0x91,0xD6,0xE1,0x27,0xB2,0xE9,0x87},
{0x70,0x28,0xAE,0x8F,0xD1,0xF5,0x74,0x1A},
{0xAA,0x37,0x80,0xBB,0xF3,0x22,0x1D,0xDE},
{0xA6,0xC4,0xD2,0x5E,0x28,0x93,0xAC,0xB3},
{0x22,0x07,0x81,0x5A,0xE4,0xB7,0x1A,0xAD},
{0xDC,0xCE,0x05,0xE7,0x07,0xBD,0xF5,0x84},
{0x26,0x1D,0x39,0x2C,0xB3,0xBA,0xA5,0x85},
{0xB4,0xF7,0x0F,0x72,0xFB,0x04,0xF0,0xDC},
{0x95,0xBA,0xA9,0x4E,0x87,0x36,0xF2,0x89},
{0xD4,0x07,0x3A,0xF1,0x5A,0x17,0x82,0x0E},
{0xEF,0x6F,0xAF,0xA7,0x66,0x1A,0x7E,0x89},
{0xC1,0x97,0xF5,0x58,0x74,0x8A,0x20,0xE7},
{0x43,0x34,0xCF,0xDA,0x22,0xC4,0x86,0xC8},
{0x08,0xD7,0xB4,0xFB,0x62,0x9D,0x08,0x85}};
static unsigned char cbc_key [8]={0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
static unsigned char cbc2_key[8]={0xf0,0xe1,0xd2,0xc3,0xb4,0xa5,0x96,0x87};
static unsigned char cbc3_key[8]={0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10};
static unsigned char cbc_iv [8]={0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10};
static char cbc_data[40]="7654321 Now is the time for \0001";
static unsigned char cbc_ok[32]={
0xcc,0xd1,0x73,0xff,0xab,0x20,0x39,0xf4,
0xac,0xd8,0xae,0xfd,0xdf,0xd8,0xa1,0xeb,
0x46,0x8e,0x91,0x15,0x78,0x88,0xba,0x68,
0x1d,0x26,0x93,0x97,0xf7,0xfe,0x62,0xb4};
static unsigned char xcbc_ok[32]={
0x86,0x74,0x81,0x0D,0x61,0xA4,0xA5,0x48,
0xB9,0x93,0x03,0xE1,0xB8,0xBB,0xBD,0xBD,
0x64,0x30,0x0B,0xB9,0x06,0x65,0x81,0x76,
0x04,0x1D,0x77,0x62,0x17,0xCA,0x2B,0xD2,
};
static unsigned char cbc3_ok[32]={
0x3F,0xE3,0x01,0xC9,0x62,0xAC,0x01,0xD0,
0x22,0x13,0x76,0x3C,0x1C,0xBD,0x4C,0xDC,
0x79,0x96,0x57,0xC0,0x64,0xEC,0xF5,0xD4,
0x1C,0x67,0x38,0x12,0xCF,0xDE,0x96,0x75};
static unsigned char pcbc_ok[32]={
0xcc,0xd1,0x73,0xff,0xab,0x20,0x39,0xf4,
0x6d,0xec,0xb4,0x70,0xa0,0xe5,0x6b,0x15,
0xae,0xa6,0xbf,0x61,0xed,0x7d,0x9c,0x9f,
0xf7,0x17,0x46,0x3b,0x8a,0xb3,0xcc,0x88};
static unsigned char cfb_key[8]={0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
static unsigned char cfb_iv[8]={0x12,0x34,0x56,0x78,0x90,0xab,0xcd,0xef};
static unsigned char cfb_buf1[40],cfb_buf2[40],cfb_tmp[8];
static unsigned char plain[24]=
{
0x4e,0x6f,0x77,0x20,0x69,0x73,
0x20,0x74,0x68,0x65,0x20,0x74,
0x69,0x6d,0x65,0x20,0x66,0x6f,
0x72,0x20,0x61,0x6c,0x6c,0x20
};
static unsigned char cfb_cipher8[24]= {
0xf3,0x1f,0xda,0x07,0x01,0x14, 0x62,0xee,0x18,0x7f,0x43,0xd8,
0x0a,0x7c,0xd9,0xb5,0xb0,0xd2, 0x90,0xda,0x6e,0x5b,0x9a,0x87 };
static unsigned char cfb_cipher16[24]={
0xF3,0x09,0x87,0x87,0x7F,0x57, 0xF7,0x3C,0x36,0xB6,0xDB,0x70,
0xD8,0xD5,0x34,0x19,0xD3,0x86, 0xB2,0x23,0xB7,0xB2,0xAD,0x1B };
static unsigned char cfb_cipher32[24]={
0xF3,0x09,0x62,0x49,0xA4,0xDF, 0xA4,0x9F,0x33,0xDC,0x7B,0xAD,
0x4C,0xC8,0x9F,0x64,0xE4,0x53, 0xE5,0xEC,0x67,0x20,0xDA,0xB6 };
static unsigned char cfb_cipher48[24]={
0xF3,0x09,0x62,0x49,0xC7,0xF4, 0x30,0xB5,0x15,0xEC,0xBB,0x85,
0x97,0x5A,0x13,0x8C,0x68,0x60, 0xE2,0x38,0x34,0x3C,0xDC,0x1F };
static unsigned char cfb_cipher64[24]={
0xF3,0x09,0x62,0x49,0xC7,0xF4, 0x6E,0x51,0xA6,0x9E,0x83,0x9B,
0x1A,0x92,0xF7,0x84,0x03,0x46, 0x71,0x33,0x89,0x8E,0xA6,0x22 };
static unsigned char ofb_key[8]={0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef};
static unsigned char ofb_iv[8]={0x12,0x34,0x56,0x78,0x90,0xab,0xcd,0xef};
static unsigned char ofb_buf1[24],ofb_buf2[24],ofb_tmp[8];
static unsigned char ofb_cipher[24]=
{
0xf3,0x09,0x62,0x49,0xc7,0xf4,0x6e,0x51,
0x35,0xf2,0x4a,0x24,0x2e,0xeb,0x3d,0x3f,
0x3d,0x6d,0x5b,0xe3,0x25,0x5a,0xf8,0xc3
};
DES_LONG cbc_cksum_ret=0xB462FEF7L;
unsigned char cbc_cksum_data[8]={0x1D,0x26,0x93,0x97,0xf7,0xfe,0x62,0xb4};
#ifndef NOPROTO
static char *pt(unsigned char *p);
static int cfb_test(int bits, unsigned char *cfb_cipher);
static int cfb64_test(unsigned char *cfb_cipher);
static int ede_cfb64_test(unsigned char *cfb_cipher);
#else
static char *pt();
static int cfb_test();
static int cfb64_test();
static int ede_cfb64_test();
#endif
int main(argc,argv)
int argc;
char *argv[];
{
int i,j,err=0;
des_cblock in,out,outin,iv3;
des_key_schedule ks,ks2,ks3;
unsigned char cbc_in[40];
unsigned char cbc_out[40];
DES_LONG cs;
unsigned char qret[4][4],cret[8];
DES_LONG lqret[4];
int num;
char *str;
printf("Doing ecb\n");
for (i=0; i<NUM_TESTS; i++)
{
if ((j=des_key_sched((C_Block *)(key_data[i]),ks)) != 0)
{
printf("Key error %2d:%d\n",i+1,j);
err=1;
}
memcpy(in,plain_data[i],8);
memset(out,0,8);
memset(outin,0,8);
des_ecb_encrypt((C_Block *)in,(C_Block *)out,ks,DES_ENCRYPT);
des_ecb_encrypt((C_Block *)out,(C_Block *)outin,ks,DES_DECRYPT);
if (memcmp(out,cipher_data[i],8) != 0)
{
printf("Encryption error %2d\nk=%s p=%s o=%s act=%s\n",
i+1,pt(key_data[i]),pt(in),pt(cipher_data[i]),
pt(out));
err=1;
}
if (memcmp(in,outin,8) != 0)
{
printf("Decryption error %2d\nk=%s p=%s o=%s act=%s\n",
i+1,pt(key_data[i]),pt(out),pt(in),pt(outin));
err=1;
}
}
#ifndef LIBDES_LIT
printf("Doing ede ecb\n");
for (i=0; i<(NUM_TESTS-1); i++)
{
if ((j=des_key_sched((C_Block *)(key_data[i]),ks)) != 0)
{
err=1;
printf("Key error %2d:%d\n",i+1,j);
}
if ((j=des_key_sched((C_Block *)(key_data[i+1]),ks2)) != 0)
{
printf("Key error %2d:%d\n",i+2,j);
err=1;
}
if ((j=des_key_sched((C_Block *)(key_data[i+2]),ks3)) != 0)
{
printf("Key error %2d:%d\n",i+3,j);
err=1;
}
memcpy(in,plain_data[i],8);
memset(out,0,8);
memset(outin,0,8);
des_ecb2_encrypt((C_Block *)in,(C_Block *)out,ks,ks2,
DES_ENCRYPT);
des_ecb2_encrypt((C_Block *)out,(C_Block *)outin,ks,ks2,
DES_DECRYPT);
if (memcmp(out,cipher_ecb2[i],8) != 0)
{
printf("Encryption error %2d\nk=%s p=%s o=%s act=%s\n",
i+1,pt(key_data[i]),pt(in),pt(cipher_ecb2[i]),
pt(out));
err=1;
}
if (memcmp(in,outin,8) != 0)
{
printf("Decryption error %2d\nk=%s p=%s o=%s act=%s\n",
i+1,pt(key_data[i]),pt(out),pt(in),pt(outin));
err=1;
}
}
#endif
printf("Doing cbc\n");
if ((j=des_key_sched((C_Block *)cbc_key,ks)) != 0)
{
printf("Key error %d\n",j);
err=1;
}
memset(cbc_out,0,40);
memset(cbc_in,0,40);
memcpy(iv3,cbc_iv,sizeof(cbc_iv));
des_ncbc_encrypt((C_Block *)cbc_data,(C_Block *)cbc_out,
(long)strlen((char *)cbc_data)+1,ks,
(C_Block *)iv3,DES_ENCRYPT);
if (memcmp(cbc_out,cbc_ok,32) != 0)
printf("cbc_encrypt encrypt error\n");
memcpy(iv3,cbc_iv,sizeof(cbc_iv));
des_ncbc_encrypt((C_Block *)cbc_out,(C_Block *)cbc_in,
(long)strlen((char *)cbc_data)+1,ks,
(C_Block *)iv3,DES_DECRYPT);
if (memcmp(cbc_in,cbc_data,strlen((char *)cbc_data)) != 0)
{
printf("cbc_encrypt decrypt error\n");
err=1;
}
#ifndef LIBDES_LIT
printf("Doing desx cbc\n");
if ((j=des_key_sched((C_Block *)cbc_key,ks)) != 0)
{
printf("Key error %d\n",j);
err=1;
}
memset(cbc_out,0,40);
memset(cbc_in,0,40);
memcpy(iv3,cbc_iv,sizeof(cbc_iv));
des_xcbc_encrypt((C_Block *)cbc_data,(C_Block *)cbc_out,
(long)strlen((char *)cbc_data)+1,ks,
(C_Block *)iv3,
(C_Block *)cbc2_key, (C_Block *)cbc3_key, DES_ENCRYPT);
if (memcmp(cbc_out,xcbc_ok,32) != 0)
{
printf("des_xcbc_encrypt encrypt error\n");
}
memcpy(iv3,cbc_iv,sizeof(cbc_iv));
des_xcbc_encrypt((C_Block *)cbc_out,(C_Block *)cbc_in,
(long)strlen((char *)cbc_data)+1,ks,
(C_Block *)iv3,
(C_Block *)cbc2_key, (C_Block *)cbc3_key, DES_DECRYPT);
if (memcmp(cbc_in,cbc_data,strlen((char *)cbc_data)+1) != 0)
{
printf("des_xcbc_encrypt decrypt error\n");
err=1;
}
#endif
printf("Doing ede cbc\n");
if ((j=des_key_sched((C_Block *)cbc_key,ks)) != 0)
{
printf("Key error %d\n",j);
err=1;
}
if ((j=des_key_sched((C_Block *)cbc2_key,ks2)) != 0)
{
printf("Key error %d\n",j);
err=1;
}
if ((j=des_key_sched((C_Block *)cbc3_key,ks3)) != 0)
{
printf("Key error %d\n",j);
err=1;
}
memset(cbc_out,0,40);
memset(cbc_in,0,40);
i=strlen((char *)cbc_data)+1;
/* i=((i+7)/8)*8; */
memcpy(iv3,cbc_iv,sizeof(cbc_iv));
des_ede3_cbc_encrypt((C_Block *)cbc_data,(C_Block *)cbc_out,
16L,ks,ks2,ks3,(C_Block *)iv3,DES_ENCRYPT);
des_ede3_cbc_encrypt((C_Block *)&(cbc_data[16]),
(C_Block *)&(cbc_out[16]),
(long)i-16,ks,ks2,ks3,(C_Block *)iv3,DES_ENCRYPT);
if (memcmp(cbc_out,cbc3_ok,
(unsigned int)(strlen((char *)cbc_data)+1+7)/8*8) != 0)
{
printf("des_ede3_cbc_encrypt encrypt error\n");
err=1;
}
memcpy(iv3,cbc_iv,sizeof(cbc_iv));
des_ede3_cbc_encrypt((C_Block *)cbc_out,(C_Block *)cbc_in,
(long)i,ks,ks2,ks3,(C_Block *)iv3,DES_DECRYPT);
if (memcmp(cbc_in,cbc_data,strlen(cbc_data)+1) != 0)
{
printf("des_ede3_cbc_encrypt decrypt error\n");
err=1;
}
#ifndef LIBDES_LIT
printf("Doing pcbc\n");
if ((j=des_key_sched((C_Block *)cbc_key,ks)) != 0)
{
printf("Key error %d\n",j);
err=1;
}
memset(cbc_out,0,40);
memset(cbc_in,0,40);
des_pcbc_encrypt((C_Block *)cbc_data,(C_Block *)cbc_out,
(long)strlen(cbc_data)+1,ks,(C_Block *)cbc_iv,DES_ENCRYPT);
if (memcmp(cbc_out,pcbc_ok,32) != 0)
{
printf("pcbc_encrypt encrypt error\n");
err=1;
}
des_pcbc_encrypt((C_Block *)cbc_out,(C_Block *)cbc_in,
(long)strlen(cbc_data)+1,ks,(C_Block *)cbc_iv,DES_DECRYPT);
if (memcmp(cbc_in,cbc_data,strlen(cbc_data)+1) != 0)
{
printf("pcbc_encrypt decrypt error\n");
err=1;
}
printf("Doing ");
printf("cfb8 ");
err+=cfb_test(8,cfb_cipher8);
printf("cfb16 ");
err+=cfb_test(16,cfb_cipher16);
printf("cfb32 ");
err+=cfb_test(32,cfb_cipher32);
printf("cfb48 ");
err+=cfb_test(48,cfb_cipher48);
printf("cfb64 ");
err+=cfb_test(64,cfb_cipher64);
printf("cfb64() ");
err+=cfb64_test(cfb_cipher64);
memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
for (i=0; i<sizeof(plain); i++)
des_cfb_encrypt(&(plain[i]),&(cfb_buf1[i]),
8,(long)1,ks,(C_Block *)cfb_tmp,DES_ENCRYPT);
if (memcmp(cfb_cipher8,cfb_buf1,sizeof(plain)) != 0)
{
printf("cfb_encrypt small encrypt error\n");
err=1;
}
memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
for (i=0; i<sizeof(plain); i++)
des_cfb_encrypt(&(cfb_buf1[i]),&(cfb_buf2[i]),
8,(long)1,ks,(C_Block *)cfb_tmp,DES_DECRYPT);
if (memcmp(plain,cfb_buf2,sizeof(plain)) != 0)
{
printf("cfb_encrypt small decrypt error\n");
err=1;
}
printf("ede_cfb64() ");
err+=ede_cfb64_test(cfb_cipher64);
printf("done\n");
printf("Doing ofb\n");
des_key_sched((C_Block *)ofb_key,ks);
memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
des_ofb_encrypt(plain,ofb_buf1,64,(long)sizeof(plain)/8,ks,
(C_Block *)ofb_tmp);
if (memcmp(ofb_cipher,ofb_buf1,sizeof(ofb_buf1)) != 0)
{
printf("ofb_encrypt encrypt error\n");
printf("%02X %02X %02X %02X %02X %02X %02X %02X\n",
ofb_buf1[8+0], ofb_buf1[8+1], ofb_buf1[8+2], ofb_buf1[8+3],
ofb_buf1[8+4], ofb_buf1[8+5], ofb_buf1[8+6], ofb_buf1[8+7]);
printf("%02X %02X %02X %02X %02X %02X %02X %02X\n",
ofb_buf1[8+0], ofb_cipher[8+1], ofb_cipher[8+2], ofb_cipher[8+3],
ofb_buf1[8+4], ofb_cipher[8+5], ofb_cipher[8+6], ofb_cipher[8+7]);
err=1;
}
memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
des_ofb_encrypt(ofb_buf1,ofb_buf2,64,(long)sizeof(ofb_buf1)/8,ks,
(C_Block *)ofb_tmp);
if (memcmp(plain,ofb_buf2,sizeof(ofb_buf2)) != 0)
{
printf("ofb_encrypt decrypt error\n");
printf("%02X %02X %02X %02X %02X %02X %02X %02X\n",
ofb_buf2[8+0], ofb_buf2[8+1], ofb_buf2[8+2], ofb_buf2[8+3],
ofb_buf2[8+4], ofb_buf2[8+5], ofb_buf2[8+6], ofb_buf2[8+7]);
printf("%02X %02X %02X %02X %02X %02X %02X %02X\n",
plain[8+0], plain[8+1], plain[8+2], plain[8+3],
plain[8+4], plain[8+5], plain[8+6], plain[8+7]);
err=1;
}
printf("Doing ofb64\n");
des_key_sched((C_Block *)ofb_key,ks);
memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
memset(ofb_buf1,0,sizeof(ofb_buf1));
memset(ofb_buf2,0,sizeof(ofb_buf1));
num=0;
for (i=0; i<sizeof(plain); i++)
{
des_ofb64_encrypt(&(plain[i]),&(ofb_buf1[i]),1,ks,
(C_Block *)ofb_tmp,&num);
}
if (memcmp(ofb_cipher,ofb_buf1,sizeof(ofb_buf1)) != 0)
{
printf("ofb64_encrypt encrypt error\n");
err=1;
}
memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
num=0;
des_ofb64_encrypt(ofb_buf1,ofb_buf2,(long)sizeof(ofb_buf1),ks,
(C_Block *)ofb_tmp,&num);
if (memcmp(plain,ofb_buf2,sizeof(ofb_buf2)) != 0)
{
printf("ofb64_encrypt decrypt error\n");
err=1;
}
printf("Doing ede_ofb64\n");
des_key_sched((C_Block *)ofb_key,ks);
memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
memset(ofb_buf1,0,sizeof(ofb_buf1));
memset(ofb_buf2,0,sizeof(ofb_buf1));
num=0;
for (i=0; i<sizeof(plain); i++)
{
des_ede3_ofb64_encrypt(&(plain[i]),&(ofb_buf1[i]),1,ks,ks,ks,
(C_Block *)ofb_tmp,&num);
}
if (memcmp(ofb_cipher,ofb_buf1,sizeof(ofb_buf1)) != 0)
{
printf("ede_ofb64_encrypt encrypt error\n");
err=1;
}
memcpy(ofb_tmp,ofb_iv,sizeof(ofb_iv));
num=0;
des_ede3_ofb64_encrypt(ofb_buf1,ofb_buf2,(long)sizeof(ofb_buf1),ks,
ks,ks,(C_Block *)ofb_tmp,&num);
if (memcmp(plain,ofb_buf2,sizeof(ofb_buf2)) != 0)
{
printf("ede_ofb64_encrypt decrypt error\n");
err=1;
}
printf("Doing cbc_cksum\n");
des_key_sched((C_Block *)cbc_key,ks);
cs=des_cbc_cksum((C_Block *)cbc_data,(C_Block *)cret,
(long)strlen(cbc_data),ks,(C_Block *)cbc_iv);
if (cs != cbc_cksum_ret)
{
printf("bad return value (%08lX), should be %08lX\n",
(unsigned long)cs,(unsigned long)cbc_cksum_ret);
err=1;
}
if (memcmp(cret,cbc_cksum_data,8) != 0)
{
printf("bad cbc_cksum block returned\n");
err=1;
}
printf("Doing quad_cksum\n");
cs=quad_cksum((C_Block *)cbc_data,(C_Block *)qret,
(long)strlen(cbc_data),2,(C_Block *)cbc_iv);
for (i=0; i<4; i++)
{
lqret[i]=0;
memcpy(&(lqret[i]),&(qret[i][0]),4);
}
{ /* Big-endian fix */
static DES_LONG l=1;
static unsigned char *c=(unsigned char *)&l;
DES_LONG ll;
if (!c[0])
{
ll=lqret[0]^lqret[3];
lqret[0]^=ll;
lqret[3]^=ll;
ll=lqret[1]^lqret[2];
lqret[1]^=ll;
lqret[2]^=ll;
}
}
if (cs != 0x70d7a63aL)
{
printf("quad_cksum error, ret %08lx should be 70d7a63a\n",
(unsigned long)cs);
err=1;
}
if (lqret[0] != 0x327eba8dL)
{
printf("quad_cksum error, out[0] %08lx is not %08lx\n",
(unsigned long)lqret[0],0x327eba8dL);
err=1;
}
if (lqret[1] != 0x201a49ccL)
{
printf("quad_cksum error, out[1] %08lx is not %08lx\n",
(unsigned long)lqret[1],0x201a49ccL);
err=1;
}
if (lqret[2] != 0x70d7a63aL)
{
printf("quad_cksum error, out[2] %08lx is not %08lx\n",
(unsigned long)lqret[2],0x70d7a63aL);
err=1;
}
if (lqret[3] != 0x501c2c26L)
{
printf("quad_cksum error, out[3] %08lx is not %08lx\n",
(unsigned long)lqret[3],0x501c2c26L);
err=1;
}
#endif
printf("input word alignment test");
for (i=0; i<4; i++)
{
printf(" %d",i);
des_ncbc_encrypt((C_Block *)&(cbc_out[i]),(C_Block *)cbc_in,
(long)strlen(cbc_data)+1,ks,(C_Block *)cbc_iv,
DES_ENCRYPT);
}
printf("\noutput word alignment test");
for (i=0; i<4; i++)
{
printf(" %d",i);
des_ncbc_encrypt((C_Block *)cbc_out,(C_Block *)&(cbc_in[i]),
(long)strlen(cbc_data)+1,ks,(C_Block *)cbc_iv,
DES_ENCRYPT);
}
printf("\n");
printf("fast crypt test ");
str=crypt("testing","ef");
if (strcmp("efGnQx2725bI2",str) != 0)
{
printf("fast crypt error, %s should be efGnQx2725bI2\n",str);
err=1;
}
str=crypt("bca76;23","yA");
if (strcmp("yA1Rp/1hZXIJk",str) != 0)
{
printf("fast crypt error, %s should be yA1Rp/1hZXIJk\n",str);
err=1;
}
printf("\n");
exit(err);
return(0);
}
static char *pt(p)
unsigned char *p;
{
static char bufs[10][20];
static int bnum=0;
char *ret;
int i;
static char *f="0123456789ABCDEF";
ret= &(bufs[bnum++][0]);
bnum%=10;
for (i=0; i<8; i++)
{
ret[i*2]=f[(p[i]>>4)&0xf];
ret[i*2+1]=f[p[i]&0xf];
}
ret[16]='\0';
return(ret);
}
#ifndef LIBDES_LIT
static int cfb_test(bits, cfb_cipher)
int bits;
unsigned char *cfb_cipher;
{
des_key_schedule ks;
int i,err=0;
des_key_sched((C_Block *)cfb_key,ks);
memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
des_cfb_encrypt(plain,cfb_buf1,bits,(long)sizeof(plain),ks,
(C_Block *)cfb_tmp,DES_ENCRYPT);
if (memcmp(cfb_cipher,cfb_buf1,sizeof(plain)) != 0)
{
err=1;
printf("cfb_encrypt encrypt error\n");
for (i=0; i<24; i+=8)
printf("%s\n",pt(&(cfb_buf1[i])));
}
memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
des_cfb_encrypt(cfb_buf1,cfb_buf2,bits,(long)sizeof(plain),ks,
(C_Block *)cfb_tmp,DES_DECRYPT);
if (memcmp(plain,cfb_buf2,sizeof(plain)) != 0)
{
err=1;
printf("cfb_encrypt decrypt error\n");
for (i=0; i<24; i+=8)
printf("%s\n",pt(&(cfb_buf1[i])));
}
return(err);
}
static int cfb64_test(cfb_cipher)
unsigned char *cfb_cipher;
{
des_key_schedule ks;
int err=0,i,n;
des_key_sched((C_Block *)cfb_key,ks);
memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
n=0;
des_cfb64_encrypt(plain,cfb_buf1,(long)12,ks,
(C_Block *)cfb_tmp,&n,DES_ENCRYPT);
des_cfb64_encrypt(&(plain[12]),&(cfb_buf1[12]),
(long)sizeof(plain)-12,ks,
(C_Block *)cfb_tmp,&n,DES_ENCRYPT);
if (memcmp(cfb_cipher,cfb_buf1,sizeof(plain)) != 0)
{
err=1;
printf("cfb_encrypt encrypt error\n");
for (i=0; i<24; i+=8)
printf("%s\n",pt(&(cfb_buf1[i])));
}
memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
n=0;
des_cfb64_encrypt(cfb_buf1,cfb_buf2,(long)17,ks,
(C_Block *)cfb_tmp,&n,DES_DECRYPT);
des_cfb64_encrypt(&(cfb_buf1[17]),&(cfb_buf2[17]),
(long)sizeof(plain)-17,ks,
(C_Block *)cfb_tmp,&n,DES_DECRYPT);
if (memcmp(plain,cfb_buf2,sizeof(plain)) != 0)
{
err=1;
printf("cfb_encrypt decrypt error\n");
for (i=0; i<24; i+=8)
printf("%s\n",pt(&(cfb_buf2[i])));
}
return(err);
}
static int ede_cfb64_test(cfb_cipher)
unsigned char *cfb_cipher;
{
des_key_schedule ks;
int err=0,i,n;
des_key_sched((C_Block *)cfb_key,ks);
memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
n=0;
des_ede3_cfb64_encrypt(plain,cfb_buf1,(long)12,ks,ks,ks,
(C_Block *)cfb_tmp,&n,DES_ENCRYPT);
des_ede3_cfb64_encrypt(&(plain[12]),&(cfb_buf1[12]),
(long)sizeof(plain)-12,ks,ks,ks,
(C_Block *)cfb_tmp,&n,DES_ENCRYPT);
if (memcmp(cfb_cipher,cfb_buf1,sizeof(plain)) != 0)
{
err=1;
printf("ede_cfb_encrypt encrypt error\n");
for (i=0; i<24; i+=8)
printf("%s\n",pt(&(cfb_buf1[i])));
}
memcpy(cfb_tmp,cfb_iv,sizeof(cfb_iv));
n=0;
des_ede3_cfb64_encrypt(cfb_buf1,cfb_buf2,(long)17,ks,ks,ks,
(C_Block *)cfb_tmp,&n,DES_DECRYPT);
des_ede3_cfb64_encrypt(&(cfb_buf1[17]),&(cfb_buf2[17]),
(long)sizeof(plain)-17,ks,ks,ks,
(C_Block *)cfb_tmp,&n,DES_DECRYPT);
if (memcmp(plain,cfb_buf2,sizeof(plain)) != 0)
{
err=1;
printf("ede_cfb_encrypt decrypt error\n");
for (i=0; i<24; i+=8)
printf("%s\n",pt(&(cfb_buf2[i])));
}
return(err);
}
#endif
linux/crypto/ciphers/des/dx86unix.S
+3160
View File
File diff suppressed because it is too large Load Diff
linux/crypto/ciphers/des/ecb_enc.c
+128
View File
@@ -0,0 +1,128 @@
/* crypto/des/ecb_enc.c */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
#include "des_locl.h"
#include "spr.h"
char *libdes_version="libdes v 3.24 - 20-Apr-1996 - eay";
char *DES_version="DES part of SSLeay 0.8.2b 08-Jan-1998";
/* RCSID $Id: ecb_enc.c,v 1.1 2004/03/15 20:35:25 as Exp $ */
/* This function ifdef'ed out for FreeS/WAN project. */
#ifdef notdef
char *des_options()
{
static int init=1;
static char buf[32];
if (init)
{
char *ptr,*unroll,*risc,*size;
init=0;
#ifdef DES_PTR
ptr="ptr";
#else
ptr="idx";
#endif
#if defined(DES_RISC1) || defined(DES_RISC2)
#ifdef DES_RISC1
risc="risc1";
#endif
#ifdef DES_RISC2
risc="risc2";
#endif
#else
risc="cisc";
#endif
#ifdef DES_UNROLL
unroll="16";
#else
unroll="4";
#endif
if (sizeof(DES_LONG) != sizeof(long))
size="int";
else
size="long";
sprintf(buf,"des(%s,%s,%s,%s)",ptr,risc,unroll,size);
}
return(buf);
}
#endif
void des_ecb_encrypt(input, output, ks, enc)
des_cblock (*input);
des_cblock (*output);
des_key_schedule ks;
int enc;
{
register DES_LONG l;
register unsigned char *in,*out;
DES_LONG ll[2];
in=(unsigned char *)input;
out=(unsigned char *)output;
c2l(in,l); ll[0]=l;
c2l(in,l); ll[1]=l;
des_encrypt(ll,ks,enc);
l=ll[0]; l2c(l,out);
l=ll[1]; l2c(l,out);
l=ll[0]=ll[1]=0;
}
linux/crypto/ciphers/des/fcrypt.c
+152
View File
@@ -0,0 +1,152 @@
/* NOCW */
/* This version of crypt has been developed from my MIT compatable
* DES library.
* The library is available at pub/Crypto/DES at ftp.psy.uq.oz.au
* Eric Young ([email protected])
*/
/* Modification by Jens Kupferschmidt (Cu)
* I have included directive PARA for shared memory computers.
* I have included a directive LONGCRYPT to using this routine to cipher
* passwords with more then 8 bytes like HP-UX 10.x it used. The MAXPLEN
* definition is the maximum of lenght of password and can changed. I have
* defined 24.
*/
#include "des_locl.h"
/* Added more values to handle illegal salt values the way normal
* crypt() implementations do. The patch was sent by
* Bjorn Gronvall <[email protected]>
*/
static unsigned const char con_salt[128]={
0xD2,0xD3,0xD4,0xD5,0xD6,0xD7,0xD8,0xD9,
0xDA,0xDB,0xDC,0xDD,0xDE,0xDF,0xE0,0xE1,
0xE2,0xE3,0xE4,0xE5,0xE6,0xE7,0xE8,0xE9,
0xEA,0xEB,0xEC,0xED,0xEE,0xEF,0xF0,0xF1,
0xF2,0xF3,0xF4,0xF5,0xF6,0xF7,0xF8,0xF9,
0xFA,0xFB,0xFC,0xFD,0xFE,0xFF,0x00,0x01,
0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,
0x0A,0x0B,0x05,0x06,0x07,0x08,0x09,0x0A,
0x0B,0x0C,0x0D,0x0E,0x0F,0x10,0x11,0x12,
0x13,0x14,0x15,0x16,0x17,0x18,0x19,0x1A,
0x1B,0x1C,0x1D,0x1E,0x1F,0x20,0x21,0x22,
0x23,0x24,0x25,0x20,0x21,0x22,0x23,0x24,
0x25,0x26,0x27,0x28,0x29,0x2A,0x2B,0x2C,
0x2D,0x2E,0x2F,0x30,0x31,0x32,0x33,0x34,
0x35,0x36,0x37,0x38,0x39,0x3A,0x3B,0x3C,
0x3D,0x3E,0x3F,0x40,0x41,0x42,0x43,0x44,
};
static unsigned const char cov_2char[64]={
0x2E,0x2F,0x30,0x31,0x32,0x33,0x34,0x35,
0x36,0x37,0x38,0x39,0x41,0x42,0x43,0x44,
0x45,0x46,0x47,0x48,0x49,0x4A,0x4B,0x4C,
0x4D,0x4E,0x4F,0x50,0x51,0x52,0x53,0x54,
0x55,0x56,0x57,0x58,0x59,0x5A,0x61,0x62,
0x63,0x64,0x65,0x66,0x67,0x68,0x69,0x6A,
0x6B,0x6C,0x6D,0x6E,0x6F,0x70,0x71,0x72,
0x73,0x74,0x75,0x76,0x77,0x78,0x79,0x7A
};
#ifndef NOPROTO
void fcrypt_body(DES_LONG *out,des_key_schedule ks,
DES_LONG Eswap0, DES_LONG Eswap1);
#ifdef PERL5
char *des_crypt(const char *buf,const char *salt);
#else
char *crypt(const char *buf,const char *salt);
#endif
#else
void fcrypt_body();
#ifdef PERL5
char *des_crypt();
#else
char *crypt();
#endif
#endif
#ifdef PERL5
char *des_crypt(buf,salt)
#else
char *crypt(buf,salt)
#endif
const char *buf;
const char *salt;
{
static char buff[14];
return(des_fcrypt(buf,salt,buff));
}
char *des_fcrypt(buf,salt,ret)
const char *buf;
const char *salt;
char *ret;
{
unsigned int i,j,x,y;
DES_LONG Eswap0,Eswap1;
DES_LONG out[2],ll;
des_cblock key;
des_key_schedule ks;
unsigned char bb[9];
unsigned char *b=bb;
unsigned char c,u;
/* eay 25/08/92
* If you call crypt("pwd","*") as often happens when you
* have * as the pwd field in /etc/passwd, the function
* returns *\0XXXXXXXXX
* The \0 makes the string look like * so the pwd "*" would
* crypt to "*". This was found when replacing the crypt in
* our shared libraries. People found that the disbled
* accounts effectivly had no passwd :-(. */
x=ret[0]=((salt[0] == '\0')?'A':salt[0]);
Eswap0=con_salt[x]<<2;
x=ret[1]=((salt[1] == '\0')?'A':salt[1]);
Eswap1=con_salt[x]<<6;
/* EAY
r=strlen(buf);
r=(r+7)/8;
*/
for (i=0; i<8; i++)
{
c= *(buf++);
if (!c) break;
key[i]=(c<<1);
}
for (; i<8; i++)
key[i]=0;
des_set_key((des_cblock *)(key),ks);
fcrypt_body(&(out[0]),ks,Eswap0,Eswap1);
ll=out[0]; l2c(ll,b);
ll=out[1]; l2c(ll,b);
y=0;
u=0x80;
bb[8]=0;
for (i=2; i<13; i++)
{
c=0;
for (j=0; j<6; j++)
{
c<<=1;
if (bb[y] & u) c|=1;
u>>=1;
if (!u)
{
y++;
u=0x80;
}
}
ret[i]=cov_2char[c];
}
ret[13]='\0';
return(ret);
}
linux/crypto/ciphers/des/fcrypt_b.c
+148
View File
@@ -0,0 +1,148 @@
/* crypto/des/fcrypt_b.c */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* #include <stdio.h> */
/* This version of crypt has been developed from my MIT compatable
* DES library.
* The library is available at pub/Crypto/DES at ftp.psy.uq.oz.au
* Eric Young ([email protected])
*/
#define DES_FCRYPT
#include "des_locl.h"
#undef DES_FCRYPT
#undef PERM_OP
#define PERM_OP(a,b,t,n,m) ((t)=((((a)>>(n))^(b))&(m)),\
(b)^=(t),\
(a)^=((t)<<(n)))
#undef HPERM_OP
#define HPERM_OP(a,t,n,m) ((t)=((((a)<<(16-(n)))^(a))&(m)),\
(a)=(a)^(t)^(t>>(16-(n))))\
void fcrypt_body(out, ks, Eswap0, Eswap1)
DES_LONG *out;
des_key_schedule ks;
DES_LONG Eswap0;
DES_LONG Eswap1;
{
register DES_LONG l,r,t,u;
#ifdef DES_PTR
register unsigned char *des_SP=(unsigned char *)des_SPtrans;
#endif
register DES_LONG *s;
register int j;
register DES_LONG E0,E1;
l=0;
r=0;
s=(DES_LONG *)ks;
E0=Eswap0;
E1=Eswap1;
for (j=0; j<25; j++)
{
#ifdef DES_UNROLL
register int i;
for (i=0; i<32; i+=8)
{
D_ENCRYPT(l,r,i+0); /* 1 */
D_ENCRYPT(r,l,i+2); /* 2 */
D_ENCRYPT(l,r,i+4); /* 1 */
D_ENCRYPT(r,l,i+6); /* 2 */
}
#else
D_ENCRYPT(l,r, 0); /* 1 */
D_ENCRYPT(r,l, 2); /* 2 */
D_ENCRYPT(l,r, 4); /* 3 */
D_ENCRYPT(r,l, 6); /* 4 */
D_ENCRYPT(l,r, 8); /* 5 */
D_ENCRYPT(r,l,10); /* 6 */
D_ENCRYPT(l,r,12); /* 7 */
D_ENCRYPT(r,l,14); /* 8 */
D_ENCRYPT(l,r,16); /* 9 */
D_ENCRYPT(r,l,18); /* 10 */
D_ENCRYPT(l,r,20); /* 11 */
D_ENCRYPT(r,l,22); /* 12 */
D_ENCRYPT(l,r,24); /* 13 */
D_ENCRYPT(r,l,26); /* 14 */
D_ENCRYPT(l,r,28); /* 15 */
D_ENCRYPT(r,l,30); /* 16 */
#endif
t=l;
l=r;
r=t;
}
l=ROTATE(l,3)&0xffffffffL;
r=ROTATE(r,3)&0xffffffffL;
PERM_OP(l,r,t, 1,0x55555555L);
PERM_OP(r,l,t, 8,0x00ff00ffL);
PERM_OP(l,r,t, 2,0x33333333L);
PERM_OP(r,l,t,16,0x0000ffffL);
PERM_OP(l,r,t, 4,0x0f0f0f0fL);
out[0]=r;
out[1]=l;
}
linux/crypto/ciphers/des/options.txt
+39
View File
@@ -0,0 +1,39 @@
Note that the UNROLL option makes the 'inner' des loop unroll all 16 rounds
instead of the default 4.
RISC1 and RISC2 are 2 alternatives for the inner loop and
PTR means to use pointers arithmatic instead of arrays.
FreeBSD - Pentium Pro 200mhz - gcc 2.7.2.2 - assembler 577,000 4620k/s
IRIX 6.2 - R10000 195mhz - cc (-O3 -n32) - UNROLL RISC2 PTR 496,000 3968k/s
solaris 2.5.1 usparc 167mhz?? - SC4.0 - UNROLL RISC1 PTR [1] 459,400 3672k/s
FreeBSD - Pentium Pro 200mhz - gcc 2.7.2.2 - UNROLL RISC1 433,000 3468k/s
solaris 2.5.1 usparc 167mhz?? - gcc 2.7.2 - UNROLL 380,000 3041k/s
linux - pentium 100mhz - gcc 2.7.0 - assembler 281,000 2250k/s
NT 4.0 - pentium 100mhz - VC 4.2 - assembler 281,000 2250k/s
AIX 4.1? - PPC604 100mhz - cc - UNROLL 275,000 2200k/s
IRIX 5.3 - R4400 200mhz - gcc 2.6.3 - UNROLL RISC2 PTR 235,300 1882k/s
IRIX 5.3 - R4400 200mhz - cc - UNROLL RISC2 PTR 233,700 1869k/s
NT 4.0 - pentium 100mhz - VC 4.2 - UNROLL RISC1 PTR 191,000 1528k/s
DEC Alpha 165mhz?? - cc - RISC2 PTR [2] 181,000 1448k/s
linux - pentium 100mhz - gcc 2.7.0 - UNROLL RISC1 PTR 158,500 1268k/s
HPUX 10 - 9000/887 - cc - UNROLL [3] 148,000 1190k/s
solaris 2.5.1 - sparc 10 50mhz - gcc 2.7.2 - UNROLL 123,600 989k/s
IRIX 5.3 - R4000 100mhz - cc - UNROLL RISC2 PTR 101,000 808k/s
DGUX - 88100 50mhz(?) - gcc 2.6.3 - UNROLL 81,000 648k/s
solaris 2.4 486 50mhz - gcc 2.6.3 - assembler 65,000 522k/s
HPUX 10 - 9000/887 - k&r cc (default compiler) - UNROLL PTR 76,000 608k/s
solaris 2.4 486 50mhz - gcc 2.6.3 - UNROLL RISC2 43,500 344k/s
AIX - old slow one :-) - cc - 39,000 312k/s
Notes.
[1] For the ultra sparc, SunC 4.0
cc -xtarget=ultra -xarch=v8plus -Xa -xO5, running 'des_opts'
gives a speed of 344,000 des/s while 'speed' gives 459,000 des/s.
I'll record the higher since it is coming from the library but it
is all rather weird.
[2] Similar to the ultra sparc ([1]), 181,000 for 'des_opts' vs 175,000.
[3] I was unable to get access to this machine when it was not heavily loaded.
As such, my timing program was never able to get more that %30 of the CPU.
This would cause the program to give much lower speed numbers because
it would be 'fighting' to stay in the cache with the other CPU burning
processes.
linux/crypto/ciphers/des/podd.h
+75
View File
@@ -0,0 +1,75 @@
/* crypto/des/podd.h */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
static const unsigned char odd_parity[256]={
1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14,
16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47,
49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62,
64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79,
81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94,
97, 97, 98, 98,100,100,103,103,104,104,107,107,109,109,110,110,
112,112,115,115,117,117,118,118,121,121,122,122,124,124,127,127,
128,128,131,131,133,133,134,134,137,137,138,138,140,140,143,143,
145,145,146,146,148,148,151,151,152,152,155,155,157,157,158,158,
161,161,162,162,164,164,167,167,168,168,171,171,173,173,174,174,
176,176,179,179,181,181,182,182,185,185,186,186,188,188,191,191,
193,193,194,194,196,196,199,199,200,200,203,203,205,205,206,206,
208,208,211,211,213,213,214,214,217,217,218,218,220,220,223,223,
224,224,227,227,229,229,230,230,233,233,234,234,236,236,239,239,
241,241,242,242,244,244,247,247,248,248,251,251,253,253,254,254};
linux/crypto/ciphers/des/set_key.c
+246
View File
@@ -0,0 +1,246 @@
/* crypto/des/set_key.c */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* set_key.c v 1.4 eay 24/9/91
* 1.4 Speed up by 400% :-)
* 1.3 added register declarations.
* 1.2 unrolled make_key_sched a bit more
* 1.1 added norm_expand_bits
* 1.0 First working version
*/
#include "des_locl.h"
#include "podd.h"
#include "sk.h"
#ifndef NOPROTO
static int check_parity(des_cblock (*key));
#else
static int check_parity();
#endif
int des_check_key=0;
void des_set_odd_parity(key)
des_cblock (*key);
{
int i;
for (i=0; i<DES_KEY_SZ; i++)
(*key)[i]=odd_parity[(*key)[i]];
}
static int check_parity(key)
des_cblock (*key);
{
int i;
for (i=0; i<DES_KEY_SZ; i++)
{
if ((*key)[i] != odd_parity[(*key)[i]])
return(0);
}
return(1);
}
/* Weak and semi week keys as take from
* %A D.W. Davies
* %A W.L. Price
* %T Security for Computer Networks
* %I John Wiley & Sons
* %D 1984
* Many thanks to [email protected] (Steven Bellovin) for the reference
* (and actual cblock values).
*/
#define NUM_WEAK_KEY 16
static des_cblock weak_keys[NUM_WEAK_KEY]={
/* weak keys */
{0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01},
{0xFE,0xFE,0xFE,0xFE,0xFE,0xFE,0xFE,0xFE},
{0x1F,0x1F,0x1F,0x1F,0x1F,0x1F,0x1F,0x1F},
{0xE0,0xE0,0xE0,0xE0,0xE0,0xE0,0xE0,0xE0},
/* semi-weak keys */
{0x01,0xFE,0x01,0xFE,0x01,0xFE,0x01,0xFE},
{0xFE,0x01,0xFE,0x01,0xFE,0x01,0xFE,0x01},
{0x1F,0xE0,0x1F,0xE0,0x0E,0xF1,0x0E,0xF1},
{0xE0,0x1F,0xE0,0x1F,0xF1,0x0E,0xF1,0x0E},
{0x01,0xE0,0x01,0xE0,0x01,0xF1,0x01,0xF1},
{0xE0,0x01,0xE0,0x01,0xF1,0x01,0xF1,0x01},
{0x1F,0xFE,0x1F,0xFE,0x0E,0xFE,0x0E,0xFE},
{0xFE,0x1F,0xFE,0x1F,0xFE,0x0E,0xFE,0x0E},
{0x01,0x1F,0x01,0x1F,0x01,0x0E,0x01,0x0E},
{0x1F,0x01,0x1F,0x01,0x0E,0x01,0x0E,0x01},
{0xE0,0xFE,0xE0,0xFE,0xF1,0xFE,0xF1,0xFE},
{0xFE,0xE0,0xFE,0xE0,0xFE,0xF1,0xFE,0xF1}};
int des_is_weak_key(key)
des_cblock (*key);
{
int i;
for (i=0; i<NUM_WEAK_KEY; i++)
/* Added == 0 to comparision, I obviously don't run
* this section very often :-(, thanks to
* [email protected] for the fix
* eay 93/06/29
* Another problem, I was comparing only the first 4
* bytes, 97/03/18 */
if (memcmp(weak_keys[i],key,sizeof(des_cblock)) == 0) return(1);
return(0);
}
/* NOW DEFINED IN des_local.h
* See ecb_encrypt.c for a pseudo description of these macros.
* #define PERM_OP(a,b,t,n,m) ((t)=((((a)>>(n))^(b))&(m)),\
* (b)^=(t),\
* (a)=((a)^((t)<<(n))))
*/
#define HPERM_OP(a,t,n,m) ((t)=((((a)<<(16-(n)))^(a))&(m)),\
(a)=(a)^(t)^(t>>(16-(n))))
/* return 0 if key parity is odd (correct),
* return -1 if key parity error,
* return -2 if illegal weak key.
*/
int des_set_key(key, schedule)
des_cblock (*key);
des_key_schedule schedule;
{
static int shifts2[16]={0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0};
register DES_LONG c,d,t,s,t2;
register unsigned char *in;
register DES_LONG *k;
register int i;
if (des_check_key)
{
if (!check_parity(key))
return(-1);
if (des_is_weak_key(key))
return(-2);
}
k=(DES_LONG *)schedule;
in=(unsigned char *)key;
c2l(in,c);
c2l(in,d);
/* do PC1 in 60 simple operations */
/* PERM_OP(d,c,t,4,0x0f0f0f0fL);
HPERM_OP(c,t,-2, 0xcccc0000L);
HPERM_OP(c,t,-1, 0xaaaa0000L);
HPERM_OP(c,t, 8, 0x00ff0000L);
HPERM_OP(c,t,-1, 0xaaaa0000L);
HPERM_OP(d,t,-8, 0xff000000L);
HPERM_OP(d,t, 8, 0x00ff0000L);
HPERM_OP(d,t, 2, 0x33330000L);
d=((d&0x00aa00aaL)<<7L)|((d&0x55005500L)>>7L)|(d&0xaa55aa55L);
d=(d>>8)|((c&0xf0000000L)>>4);
c&=0x0fffffffL; */
/* I now do it in 47 simple operations :-)
* Thanks to John Fletcher ([email protected])
* for the inspiration. :-) */
PERM_OP (d,c,t,4,0x0f0f0f0fL);
HPERM_OP(c,t,-2,0xcccc0000L);
HPERM_OP(d,t,-2,0xcccc0000L);
PERM_OP (d,c,t,1,0x55555555L);
PERM_OP (c,d,t,8,0x00ff00ffL);
PERM_OP (d,c,t,1,0x55555555L);
d= (((d&0x000000ffL)<<16L)| (d&0x0000ff00L) |
((d&0x00ff0000L)>>16L)|((c&0xf0000000L)>>4L));
c&=0x0fffffffL;
for (i=0; i<ITERATIONS; i++)
{
if (shifts2[i])
{ c=((c>>2L)|(c<<26L)); d=((d>>2L)|(d<<26L)); }
else
{ c=((c>>1L)|(c<<27L)); d=((d>>1L)|(d<<27L)); }
c&=0x0fffffffL;
d&=0x0fffffffL;
/* could be a few less shifts but I am to lazy at this
* point in time to investigate */
s= des_skb[0][ (c )&0x3f ]|
des_skb[1][((c>> 6)&0x03)|((c>> 7L)&0x3c)]|
des_skb[2][((c>>13)&0x0f)|((c>>14L)&0x30)]|
des_skb[3][((c>>20)&0x01)|((c>>21L)&0x06) |
((c>>22L)&0x38)];
t= des_skb[4][ (d )&0x3f ]|
des_skb[5][((d>> 7L)&0x03)|((d>> 8L)&0x3c)]|
des_skb[6][ (d>>15L)&0x3f ]|
des_skb[7][((d>>21L)&0x0f)|((d>>22L)&0x30)];
/* table contained 0213 4657 */
t2=((t<<16L)|(s&0x0000ffffL))&0xffffffffL;
*(k++)=ROTATE(t2,30)&0xffffffffL;
t2=((s>>16L)|(t&0xffff0000L));
*(k++)=ROTATE(t2,26)&0xffffffffL;
}
return(0);
}
int des_key_sched(key, schedule)
des_cblock (*key);
des_key_schedule schedule;
{
return(des_set_key(key,schedule));
}
linux/crypto/ciphers/des/sk.h
+204
View File
@@ -0,0 +1,204 @@
/* crypto/des/sk.h */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
static const DES_LONG des_skb[8][64]={
{
/* for C bits (numbered as per FIPS 46) 1 2 3 4 5 6 */
0x00000000L,0x00000010L,0x20000000L,0x20000010L,
0x00010000L,0x00010010L,0x20010000L,0x20010010L,
0x00000800L,0x00000810L,0x20000800L,0x20000810L,
0x00010800L,0x00010810L,0x20010800L,0x20010810L,
0x00000020L,0x00000030L,0x20000020L,0x20000030L,
0x00010020L,0x00010030L,0x20010020L,0x20010030L,
0x00000820L,0x00000830L,0x20000820L,0x20000830L,
0x00010820L,0x00010830L,0x20010820L,0x20010830L,
0x00080000L,0x00080010L,0x20080000L,0x20080010L,
0x00090000L,0x00090010L,0x20090000L,0x20090010L,
0x00080800L,0x00080810L,0x20080800L,0x20080810L,
0x00090800L,0x00090810L,0x20090800L,0x20090810L,
0x00080020L,0x00080030L,0x20080020L,0x20080030L,
0x00090020L,0x00090030L,0x20090020L,0x20090030L,
0x00080820L,0x00080830L,0x20080820L,0x20080830L,
0x00090820L,0x00090830L,0x20090820L,0x20090830L,
},{
/* for C bits (numbered as per FIPS 46) 7 8 10 11 12 13 */
0x00000000L,0x02000000L,0x00002000L,0x02002000L,
0x00200000L,0x02200000L,0x00202000L,0x02202000L,
0x00000004L,0x02000004L,0x00002004L,0x02002004L,
0x00200004L,0x02200004L,0x00202004L,0x02202004L,
0x00000400L,0x02000400L,0x00002400L,0x02002400L,
0x00200400L,0x02200400L,0x00202400L,0x02202400L,
0x00000404L,0x02000404L,0x00002404L,0x02002404L,
0x00200404L,0x02200404L,0x00202404L,0x02202404L,
0x10000000L,0x12000000L,0x10002000L,0x12002000L,
0x10200000L,0x12200000L,0x10202000L,0x12202000L,
0x10000004L,0x12000004L,0x10002004L,0x12002004L,
0x10200004L,0x12200004L,0x10202004L,0x12202004L,
0x10000400L,0x12000400L,0x10002400L,0x12002400L,
0x10200400L,0x12200400L,0x10202400L,0x12202400L,
0x10000404L,0x12000404L,0x10002404L,0x12002404L,
0x10200404L,0x12200404L,0x10202404L,0x12202404L,
},{
/* for C bits (numbered as per FIPS 46) 14 15 16 17 19 20 */
0x00000000L,0x00000001L,0x00040000L,0x00040001L,
0x01000000L,0x01000001L,0x01040000L,0x01040001L,
0x00000002L,0x00000003L,0x00040002L,0x00040003L,
0x01000002L,0x01000003L,0x01040002L,0x01040003L,
0x00000200L,0x00000201L,0x00040200L,0x00040201L,
0x01000200L,0x01000201L,0x01040200L,0x01040201L,
0x00000202L,0x00000203L,0x00040202L,0x00040203L,
0x01000202L,0x01000203L,0x01040202L,0x01040203L,
0x08000000L,0x08000001L,0x08040000L,0x08040001L,
0x09000000L,0x09000001L,0x09040000L,0x09040001L,
0x08000002L,0x08000003L,0x08040002L,0x08040003L,
0x09000002L,0x09000003L,0x09040002L,0x09040003L,
0x08000200L,0x08000201L,0x08040200L,0x08040201L,
0x09000200L,0x09000201L,0x09040200L,0x09040201L,
0x08000202L,0x08000203L,0x08040202L,0x08040203L,
0x09000202L,0x09000203L,0x09040202L,0x09040203L,
},{
/* for C bits (numbered as per FIPS 46) 21 23 24 26 27 28 */
0x00000000L,0x00100000L,0x00000100L,0x00100100L,
0x00000008L,0x00100008L,0x00000108L,0x00100108L,
0x00001000L,0x00101000L,0x00001100L,0x00101100L,
0x00001008L,0x00101008L,0x00001108L,0x00101108L,
0x04000000L,0x04100000L,0x04000100L,0x04100100L,
0x04000008L,0x04100008L,0x04000108L,0x04100108L,
0x04001000L,0x04101000L,0x04001100L,0x04101100L,
0x04001008L,0x04101008L,0x04001108L,0x04101108L,
0x00020000L,0x00120000L,0x00020100L,0x00120100L,
0x00020008L,0x00120008L,0x00020108L,0x00120108L,
0x00021000L,0x00121000L,0x00021100L,0x00121100L,
0x00021008L,0x00121008L,0x00021108L,0x00121108L,
0x04020000L,0x04120000L,0x04020100L,0x04120100L,
0x04020008L,0x04120008L,0x04020108L,0x04120108L,
0x04021000L,0x04121000L,0x04021100L,0x04121100L,
0x04021008L,0x04121008L,0x04021108L,0x04121108L,
},{
/* for D bits (numbered as per FIPS 46) 1 2 3 4 5 6 */
0x00000000L,0x10000000L,0x00010000L,0x10010000L,
0x00000004L,0x10000004L,0x00010004L,0x10010004L,
0x20000000L,0x30000000L,0x20010000L,0x30010000L,
0x20000004L,0x30000004L,0x20010004L,0x30010004L,
0x00100000L,0x10100000L,0x00110000L,0x10110000L,
0x00100004L,0x10100004L,0x00110004L,0x10110004L,
0x20100000L,0x30100000L,0x20110000L,0x30110000L,
0x20100004L,0x30100004L,0x20110004L,0x30110004L,
0x00001000L,0x10001000L,0x00011000L,0x10011000L,
0x00001004L,0x10001004L,0x00011004L,0x10011004L,
0x20001000L,0x30001000L,0x20011000L,0x30011000L,
0x20001004L,0x30001004L,0x20011004L,0x30011004L,
0x00101000L,0x10101000L,0x00111000L,0x10111000L,
0x00101004L,0x10101004L,0x00111004L,0x10111004L,
0x20101000L,0x30101000L,0x20111000L,0x30111000L,
0x20101004L,0x30101004L,0x20111004L,0x30111004L,
},{
/* for D bits (numbered as per FIPS 46) 8 9 11 12 13 14 */
0x00000000L,0x08000000L,0x00000008L,0x08000008L,
0x00000400L,0x08000400L,0x00000408L,0x08000408L,
0x00020000L,0x08020000L,0x00020008L,0x08020008L,
0x00020400L,0x08020400L,0x00020408L,0x08020408L,
0x00000001L,0x08000001L,0x00000009L,0x08000009L,
0x00000401L,0x08000401L,0x00000409L,0x08000409L,
0x00020001L,0x08020001L,0x00020009L,0x08020009L,
0x00020401L,0x08020401L,0x00020409L,0x08020409L,
0x02000000L,0x0A000000L,0x02000008L,0x0A000008L,
0x02000400L,0x0A000400L,0x02000408L,0x0A000408L,
0x02020000L,0x0A020000L,0x02020008L,0x0A020008L,
0x02020400L,0x0A020400L,0x02020408L,0x0A020408L,
0x02000001L,0x0A000001L,0x02000009L,0x0A000009L,
0x02000401L,0x0A000401L,0x02000409L,0x0A000409L,
0x02020001L,0x0A020001L,0x02020009L,0x0A020009L,
0x02020401L,0x0A020401L,0x02020409L,0x0A020409L,
},{
/* for D bits (numbered as per FIPS 46) 16 17 18 19 20 21 */
0x00000000L,0x00000100L,0x00080000L,0x00080100L,
0x01000000L,0x01000100L,0x01080000L,0x01080100L,
0x00000010L,0x00000110L,0x00080010L,0x00080110L,
0x01000010L,0x01000110L,0x01080010L,0x01080110L,
0x00200000L,0x00200100L,0x00280000L,0x00280100L,
0x01200000L,0x01200100L,0x01280000L,0x01280100L,
0x00200010L,0x00200110L,0x00280010L,0x00280110L,
0x01200010L,0x01200110L,0x01280010L,0x01280110L,
0x00000200L,0x00000300L,0x00080200L,0x00080300L,
0x01000200L,0x01000300L,0x01080200L,0x01080300L,
0x00000210L,0x00000310L,0x00080210L,0x00080310L,
0x01000210L,0x01000310L,0x01080210L,0x01080310L,
0x00200200L,0x00200300L,0x00280200L,0x00280300L,
0x01200200L,0x01200300L,0x01280200L,0x01280300L,
0x00200210L,0x00200310L,0x00280210L,0x00280310L,
0x01200210L,0x01200310L,0x01280210L,0x01280310L,
},{
/* for D bits (numbered as per FIPS 46) 22 23 24 25 27 28 */
0x00000000L,0x04000000L,0x00040000L,0x04040000L,
0x00000002L,0x04000002L,0x00040002L,0x04040002L,
0x00002000L,0x04002000L,0x00042000L,0x04042000L,
0x00002002L,0x04002002L,0x00042002L,0x04042002L,
0x00000020L,0x04000020L,0x00040020L,0x04040020L,
0x00000022L,0x04000022L,0x00040022L,0x04040022L,
0x00002020L,0x04002020L,0x00042020L,0x04042020L,
0x00002022L,0x04002022L,0x00042022L,0x04042022L,
0x00000800L,0x04000800L,0x00040800L,0x04040800L,
0x00000802L,0x04000802L,0x00040802L,0x04040802L,
0x00002800L,0x04002800L,0x00042800L,0x04042800L,
0x00002802L,0x04002802L,0x00042802L,0x04042802L,
0x00000820L,0x04000820L,0x00040820L,0x04040820L,
0x00000822L,0x04000822L,0x00040822L,0x04040822L,
0x00002820L,0x04002820L,0x00042820L,0x04042820L,
0x00002822L,0x04002822L,0x00042822L,0x04042822L,
}};
linux/crypto/ciphers/des/speed.c
+329
View File
@@ -0,0 +1,329 @@
/* crypto/des/speed.c */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* 11-Sep-92 Andrew Daviel Support for Silicon Graphics IRIX added */
/* 06-Apr-92 Luke Brennan Support for VMS and add extra signal calls */
#ifndef MSDOS
#define TIMES
#endif
#include <stdio.h>
#ifndef MSDOS
#include <unistd.h>
#else
#include <io.h>
extern int exit();
#endif
#include <signal.h>
#ifndef VMS
#ifndef _IRIX
#include <time.h>
#endif
#ifdef TIMES
#include <sys/types.h>
#include <sys/times.h>
#endif
#else /* VMS */
#include <types.h>
struct tms {
time_t tms_utime;
time_t tms_stime;
time_t tms_uchild; /* I dunno... */
time_t tms_uchildsys; /* so these names are a guess :-) */
}
#endif
#ifndef TIMES
#include <sys/timeb.h>
#endif
#ifdef sun
#include <limits.h>
#include <sys/param.h>
#endif
#include "des_locl.h"
/* The following if from times(3) man page. It may need to be changed */
#ifndef HZ
# ifndef CLK_TCK
# ifndef _BSD_CLK_TCK_ /* FreeBSD fix */
# ifndef VMS
# define HZ 100.0
# else /* VMS */
# define HZ 100.0
# endif
# else /* _BSD_CLK_TCK_ */
# define HZ ((double)_BSD_CLK_TCK_)
# endif
# else /* CLK_TCK */
# define HZ ((double)CLK_TCK)
# endif
#endif
#define BUFSIZE ((long)1024)
long run=0;
#ifndef NOPROTO
double Time_F(int s);
#else
double Time_F();
#endif
#ifdef SIGALRM
#if defined(__STDC__) || defined(sgi) || defined(_AIX)
#define SIGRETTYPE void
#else
#define SIGRETTYPE int
#endif
#ifndef NOPROTO
SIGRETTYPE sig_done(int sig);
#else
SIGRETTYPE sig_done();
#endif
SIGRETTYPE sig_done(sig)
int sig;
{
signal(SIGALRM,sig_done);
run=0;
#ifdef LINT
sig=sig;
#endif
}
#endif
#define START 0
#define STOP 1
double Time_F(s)
int s;
{
double ret;
#ifdef TIMES
static struct tms tstart,tend;
if (s == START)
{
times(&tstart);
return(0);
}
else
{
times(&tend);
ret=((double)(tend.tms_utime-tstart.tms_utime))/HZ;
return((ret == 0.0)?1e-6:ret);
}
#else /* !times() */
static struct timeb tstart,tend;
long i;
if (s == START)
{
ftime(&tstart);
return(0);
}
else
{
ftime(&tend);
i=(long)tend.millitm-(long)tstart.millitm;
ret=((double)(tend.time-tstart.time))+((double)i)/1e3;
return((ret == 0.0)?1e-6:ret);
}
#endif
}
int main(argc,argv)
int argc;
char **argv;
{
long count;
static unsigned char buf[BUFSIZE];
static des_cblock key ={0x12,0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0};
static des_cblock key2={0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12};
static des_cblock key3={0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12,0x34};
des_key_schedule sch,sch2,sch3;
double a,b,c,d,e;
#ifndef SIGALRM
long ca,cb,cc,cd,ce;
#endif
#ifndef TIMES
printf("To get the most acurate results, try to run this\n");
printf("program when this computer is idle.\n");
#endif
des_set_key((C_Block *)key2,sch2);
des_set_key((C_Block *)key3,sch3);
#ifndef SIGALRM
printf("First we calculate the approximate speed ...\n");
des_set_key((C_Block *)key,sch);
count=10;
do {
long i;
DES_LONG data[2];
count*=2;
Time_F(START);
for (i=count; i; i--)
des_encrypt(data,&(sch[0]),DES_ENCRYPT);
d=Time_F(STOP);
} while (d < 3.0);
ca=count;
cb=count*3;
cc=count*3*8/BUFSIZE+1;
cd=count*8/BUFSIZE+1;
ce=count/20+1;
printf("Doing set_key %ld times\n",ca);
#define COND(d) (count != (d))
#define COUNT(d) (d)
#else
#define COND(c) (run)
#define COUNT(d) (count)
signal(SIGALRM,sig_done);
printf("Doing set_key for 10 seconds\n");
alarm(10);
#endif
Time_F(START);
for (count=0,run=1; COND(ca); count++)
des_set_key((C_Block *)key,sch);
d=Time_F(STOP);
printf("%ld set_key's in %.2f seconds\n",count,d);
a=((double)COUNT(ca))/d;
#ifdef SIGALRM
printf("Doing des_encrypt's for 10 seconds\n");
alarm(10);
#else
printf("Doing des_encrypt %ld times\n",cb);
#endif
Time_F(START);
for (count=0,run=1; COND(cb); count++)
{
DES_LONG data[2];
des_encrypt(data,&(sch[0]),DES_ENCRYPT);
}
d=Time_F(STOP);
printf("%ld des_encrypt's in %.2f second\n",count,d);
b=((double)COUNT(cb)*8)/d;
#ifdef SIGALRM
printf("Doing des_cbc_encrypt on %ld byte blocks for 10 seconds\n",
BUFSIZE);
alarm(10);
#else
printf("Doing des_cbc_encrypt %ld times on %ld byte blocks\n",cc,
BUFSIZE);
#endif
Time_F(START);
for (count=0,run=1; COND(cc); count++)
des_ncbc_encrypt((C_Block *)buf,(C_Block *)buf,BUFSIZE,&(sch[0]),
(C_Block *)&(key[0]),DES_ENCRYPT);
d=Time_F(STOP);
printf("%ld des_cbc_encrypt's of %ld byte blocks in %.2f second\n",
count,BUFSIZE,d);
c=((double)COUNT(cc)*BUFSIZE)/d;
#ifdef SIGALRM
printf("Doing des_ede_cbc_encrypt on %ld byte blocks for 10 seconds\n",
BUFSIZE);
alarm(10);
#else
printf("Doing des_ede_cbc_encrypt %ld times on %ld byte blocks\n",cd,
BUFSIZE);
#endif
Time_F(START);
for (count=0,run=1; COND(cd); count++)
des_ede3_cbc_encrypt((C_Block *)buf,(C_Block *)buf,BUFSIZE,
&(sch[0]),
&(sch2[0]),
&(sch3[0]),
(C_Block *)&(key[0]),
DES_ENCRYPT);
d=Time_F(STOP);
printf("%ld des_ede_cbc_encrypt's of %ld byte blocks in %.2f second\n",
count,BUFSIZE,d);
d=((double)COUNT(cd)*BUFSIZE)/d;
#ifdef SIGALRM
printf("Doing crypt for 10 seconds\n");
alarm(10);
#else
printf("Doing crypt %ld times\n",ce);
#endif
Time_F(START);
for (count=0,run=1; COND(ce); count++)
crypt("testing1","ef");
e=Time_F(STOP);
printf("%ld crypts in %.2f second\n",count,e);
e=((double)COUNT(ce))/e;
printf("set_key per sec = %12.2f (%9.3fuS)\n",a,1.0e6/a);
printf("DES raw ecb bytes per sec = %12.2f (%9.3fuS)\n",b,8.0e6/b);
printf("DES cbc bytes per sec = %12.2f (%9.3fuS)\n",c,8.0e6/c);
printf("DES ede cbc bytes per sec = %12.2f (%9.3fuS)\n",d,8.0e6/d);
printf("crypt per sec = %12.2f (%9.3fuS)\n",e,1.0e6/e);
exit(0);
#if defined(LINT) || defined(MSDOS)
return(0);
#endif
}
linux/crypto/ciphers/des/spr.h
+204
View File
@@ -0,0 +1,204 @@
/* crypto/des/spr.h */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
const DES_LONG des_SPtrans[8][64]={
{
/* nibble 0 */
0x02080800L, 0x00080000L, 0x02000002L, 0x02080802L,
0x02000000L, 0x00080802L, 0x00080002L, 0x02000002L,
0x00080802L, 0x02080800L, 0x02080000L, 0x00000802L,
0x02000802L, 0x02000000L, 0x00000000L, 0x00080002L,
0x00080000L, 0x00000002L, 0x02000800L, 0x00080800L,
0x02080802L, 0x02080000L, 0x00000802L, 0x02000800L,
0x00000002L, 0x00000800L, 0x00080800L, 0x02080002L,
0x00000800L, 0x02000802L, 0x02080002L, 0x00000000L,
0x00000000L, 0x02080802L, 0x02000800L, 0x00080002L,
0x02080800L, 0x00080000L, 0x00000802L, 0x02000800L,
0x02080002L, 0x00000800L, 0x00080800L, 0x02000002L,
0x00080802L, 0x00000002L, 0x02000002L, 0x02080000L,
0x02080802L, 0x00080800L, 0x02080000L, 0x02000802L,
0x02000000L, 0x00000802L, 0x00080002L, 0x00000000L,
0x00080000L, 0x02000000L, 0x02000802L, 0x02080800L,
0x00000002L, 0x02080002L, 0x00000800L, 0x00080802L,
},{
/* nibble 1 */
0x40108010L, 0x00000000L, 0x00108000L, 0x40100000L,
0x40000010L, 0x00008010L, 0x40008000L, 0x00108000L,
0x00008000L, 0x40100010L, 0x00000010L, 0x40008000L,
0x00100010L, 0x40108000L, 0x40100000L, 0x00000010L,
0x00100000L, 0x40008010L, 0x40100010L, 0x00008000L,
0x00108010L, 0x40000000L, 0x00000000L, 0x00100010L,
0x40008010L, 0x00108010L, 0x40108000L, 0x40000010L,
0x40000000L, 0x00100000L, 0x00008010L, 0x40108010L,
0x00100010L, 0x40108000L, 0x40008000L, 0x00108010L,
0x40108010L, 0x00100010L, 0x40000010L, 0x00000000L,
0x40000000L, 0x00008010L, 0x00100000L, 0x40100010L,
0x00008000L, 0x40000000L, 0x00108010L, 0x40008010L,
0x40108000L, 0x00008000L, 0x00000000L, 0x40000010L,
0x00000010L, 0x40108010L, 0x00108000L, 0x40100000L,
0x40100010L, 0x00100000L, 0x00008010L, 0x40008000L,
0x40008010L, 0x00000010L, 0x40100000L, 0x00108000L,
},{
/* nibble 2 */
0x04000001L, 0x04040100L, 0x00000100L, 0x04000101L,
0x00040001L, 0x04000000L, 0x04000101L, 0x00040100L,
0x04000100L, 0x00040000L, 0x04040000L, 0x00000001L,
0x04040101L, 0x00000101L, 0x00000001L, 0x04040001L,
0x00000000L, 0x00040001L, 0x04040100L, 0x00000100L,
0x00000101L, 0x04040101L, 0x00040000L, 0x04000001L,
0x04040001L, 0x04000100L, 0x00040101L, 0x04040000L,
0x00040100L, 0x00000000L, 0x04000000L, 0x00040101L,
0x04040100L, 0x00000100L, 0x00000001L, 0x00040000L,
0x00000101L, 0x00040001L, 0x04040000L, 0x04000101L,
0x00000000L, 0x04040100L, 0x00040100L, 0x04040001L,
0x00040001L, 0x04000000L, 0x04040101L, 0x00000001L,
0x00040101L, 0x04000001L, 0x04000000L, 0x04040101L,
0x00040000L, 0x04000100L, 0x04000101L, 0x00040100L,
0x04000100L, 0x00000000L, 0x04040001L, 0x00000101L,
0x04000001L, 0x00040101L, 0x00000100L, 0x04040000L,
},{
/* nibble 3 */
0x00401008L, 0x10001000L, 0x00000008L, 0x10401008L,
0x00000000L, 0x10400000L, 0x10001008L, 0x00400008L,
0x10401000L, 0x10000008L, 0x10000000L, 0x00001008L,
0x10000008L, 0x00401008L, 0x00400000L, 0x10000000L,
0x10400008L, 0x00401000L, 0x00001000L, 0x00000008L,
0x00401000L, 0x10001008L, 0x10400000L, 0x00001000L,
0x00001008L, 0x00000000L, 0x00400008L, 0x10401000L,
0x10001000L, 0x10400008L, 0x10401008L, 0x00400000L,
0x10400008L, 0x00001008L, 0x00400000L, 0x10000008L,
0x00401000L, 0x10001000L, 0x00000008L, 0x10400000L,
0x10001008L, 0x00000000L, 0x00001000L, 0x00400008L,
0x00000000L, 0x10400008L, 0x10401000L, 0x00001000L,
0x10000000L, 0x10401008L, 0x00401008L, 0x00400000L,
0x10401008L, 0x00000008L, 0x10001000L, 0x00401008L,
0x00400008L, 0x00401000L, 0x10400000L, 0x10001008L,
0x00001008L, 0x10000000L, 0x10000008L, 0x10401000L,
},{
/* nibble 4 */
0x08000000L, 0x00010000L, 0x00000400L, 0x08010420L,
0x08010020L, 0x08000400L, 0x00010420L, 0x08010000L,
0x00010000L, 0x00000020L, 0x08000020L, 0x00010400L,
0x08000420L, 0x08010020L, 0x08010400L, 0x00000000L,
0x00010400L, 0x08000000L, 0x00010020L, 0x00000420L,
0x08000400L, 0x00010420L, 0x00000000L, 0x08000020L,
0x00000020L, 0x08000420L, 0x08010420L, 0x00010020L,
0x08010000L, 0x00000400L, 0x00000420L, 0x08010400L,
0x08010400L, 0x08000420L, 0x00010020L, 0x08010000L,
0x00010000L, 0x00000020L, 0x08000020L, 0x08000400L,
0x08000000L, 0x00010400L, 0x08010420L, 0x00000000L,
0x00010420L, 0x08000000L, 0x00000400L, 0x00010020L,
0x08000420L, 0x00000400L, 0x00000000L, 0x08010420L,
0x08010020L, 0x08010400L, 0x00000420L, 0x00010000L,
0x00010400L, 0x08010020L, 0x08000400L, 0x00000420L,
0x00000020L, 0x00010420L, 0x08010000L, 0x08000020L,
},{
/* nibble 5 */
0x80000040L, 0x00200040L, 0x00000000L, 0x80202000L,
0x00200040L, 0x00002000L, 0x80002040L, 0x00200000L,
0x00002040L, 0x80202040L, 0x00202000L, 0x80000000L,
0x80002000L, 0x80000040L, 0x80200000L, 0x00202040L,
0x00200000L, 0x80002040L, 0x80200040L, 0x00000000L,
0x00002000L, 0x00000040L, 0x80202000L, 0x80200040L,
0x80202040L, 0x80200000L, 0x80000000L, 0x00002040L,
0x00000040L, 0x00202000L, 0x00202040L, 0x80002000L,
0x00002040L, 0x80000000L, 0x80002000L, 0x00202040L,
0x80202000L, 0x00200040L, 0x00000000L, 0x80002000L,
0x80000000L, 0x00002000L, 0x80200040L, 0x00200000L,
0x00200040L, 0x80202040L, 0x00202000L, 0x00000040L,
0x80202040L, 0x00202000L, 0x00200000L, 0x80002040L,
0x80000040L, 0x80200000L, 0x00202040L, 0x00000000L,
0x00002000L, 0x80000040L, 0x80002040L, 0x80202000L,
0x80200000L, 0x00002040L, 0x00000040L, 0x80200040L,
},{
/* nibble 6 */
0x00004000L, 0x00000200L, 0x01000200L, 0x01000004L,
0x01004204L, 0x00004004L, 0x00004200L, 0x00000000L,
0x01000000L, 0x01000204L, 0x00000204L, 0x01004000L,
0x00000004L, 0x01004200L, 0x01004000L, 0x00000204L,
0x01000204L, 0x00004000L, 0x00004004L, 0x01004204L,
0x00000000L, 0x01000200L, 0x01000004L, 0x00004200L,
0x01004004L, 0x00004204L, 0x01004200L, 0x00000004L,
0x00004204L, 0x01004004L, 0x00000200L, 0x01000000L,
0x00004204L, 0x01004000L, 0x01004004L, 0x00000204L,
0x00004000L, 0x00000200L, 0x01000000L, 0x01004004L,
0x01000204L, 0x00004204L, 0x00004200L, 0x00000000L,
0x00000200L, 0x01000004L, 0x00000004L, 0x01000200L,
0x00000000L, 0x01000204L, 0x01000200L, 0x00004200L,
0x00000204L, 0x00004000L, 0x01004204L, 0x01000000L,
0x01004200L, 0x00000004L, 0x00004004L, 0x01004204L,
0x01000004L, 0x01004200L, 0x01004000L, 0x00004004L,
},{
/* nibble 7 */
0x20800080L, 0x20820000L, 0x00020080L, 0x00000000L,
0x20020000L, 0x00800080L, 0x20800000L, 0x20820080L,
0x00000080L, 0x20000000L, 0x00820000L, 0x00020080L,
0x00820080L, 0x20020080L, 0x20000080L, 0x20800000L,
0x00020000L, 0x00820080L, 0x00800080L, 0x20020000L,
0x20820080L, 0x20000080L, 0x00000000L, 0x00820000L,
0x20000000L, 0x00800000L, 0x20020080L, 0x20800080L,
0x00800000L, 0x00020000L, 0x20820000L, 0x00000080L,
0x00800000L, 0x00020000L, 0x20000080L, 0x20820080L,
0x00020080L, 0x20000000L, 0x00000000L, 0x00820000L,
0x20800080L, 0x20020080L, 0x20020000L, 0x00800080L,
0x20820000L, 0x00000080L, 0x00800080L, 0x20020000L,
0x20820080L, 0x00800000L, 0x20800000L, 0x20000080L,
0x00820000L, 0x00020080L, 0x20020080L, 0x20800000L,
0x00000080L, 0x20820000L, 0x00820080L, 0x00000000L,
0x20000000L, 0x20800080L, 0x00020000L, 0x00820080L,
}};
linux/include/crypto/des.h
+308
View File
@@ -0,0 +1,308 @@
/* crypto/des/des.org */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
*
* Always modify des.org since des.h is automatically generated from
* it during SSLeay configuration.
*
* WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
*/
#ifndef HEADER_DES_H
#define HEADER_DES_H
#ifdef __cplusplus
extern "C" {
#endif
/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
* %20 speed up (longs are 8 bytes, int's are 4). */
/* Must be unsigned int on ia64/Itanium or DES breaks badly */
#ifdef __KERNEL__
#include <linux/types.h>
#else
#include <sys/types.h>
#endif
#ifndef DES_LONG
#define DES_LONG u_int32_t
#endif
typedef unsigned char des_cblock[8];
typedef struct des_ks_struct
{
union {
des_cblock _;
/* make sure things are correct size on machines with
* 8 byte longs */
DES_LONG pad[2];
} ks;
#undef _
#define _ ks._
} des_key_schedule[16];
#define DES_KEY_SZ (sizeof(des_cblock))
#define DES_SCHEDULE_SZ (sizeof(des_key_schedule))
#define DES_ENCRYPT 1
#define DES_DECRYPT 0
#define DES_CBC_MODE 0
#define DES_PCBC_MODE 1
#define des_ecb2_encrypt(i,o,k1,k2,e) \
des_ecb3_encrypt((i),(o),(k1),(k2),(k1),(e))
#define des_ede2_cbc_encrypt(i,o,l,k1,k2,iv,e) \
des_ede3_cbc_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(e))
#define des_ede2_cfb64_encrypt(i,o,l,k1,k2,iv,n,e) \
des_ede3_cfb64_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(n),(e))
#define des_ede2_ofb64_encrypt(i,o,l,k1,k2,iv,n) \
des_ede3_ofb64_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(n))
#define C_Block des_cblock
#define Key_schedule des_key_schedule
#ifdef KERBEROS
#define ENCRYPT DES_ENCRYPT
#define DECRYPT DES_DECRYPT
#endif
#define KEY_SZ DES_KEY_SZ
#define string_to_key des_string_to_key
#define read_pw_string des_read_pw_string
#define random_key des_random_key
#define pcbc_encrypt des_pcbc_encrypt
#define set_key des_set_key
#define key_sched des_key_sched
#define ecb_encrypt des_ecb_encrypt
#define cbc_encrypt des_cbc_encrypt
#define ncbc_encrypt des_ncbc_encrypt
#define xcbc_encrypt des_xcbc_encrypt
#define cbc_cksum des_cbc_cksum
#define quad_cksum des_quad_cksum
/* For compatibility with the MIT lib - eay 20/05/92 */
typedef des_key_schedule bit_64;
#define des_fixup_key_parity des_set_odd_parity
#define des_check_key_parity check_parity
extern int des_check_key; /* defaults to false */
extern int des_rw_mode; /* defaults to DES_PCBC_MODE */
/* The next line is used to disable full ANSI prototypes, if your
* compiler has problems with the prototypes, make sure this line always
* evaluates to true :-) */
#if defined(MSDOS) || defined(__STDC__)
#undef NOPROTO
#endif
#ifndef NOPROTO
char *des_options(void);
void des_ecb3_encrypt(des_cblock *input,des_cblock *output,
des_key_schedule ks1,des_key_schedule ks2,
des_key_schedule ks3, int enc);
DES_LONG des_cbc_cksum(des_cblock *input,des_cblock *output,
long length,des_key_schedule schedule,des_cblock *ivec);
void des_cbc_encrypt(des_cblock *input,des_cblock *output,long length,
des_key_schedule schedule,des_cblock *ivec,int enc);
void des_ncbc_encrypt(des_cblock *input,des_cblock *output,long length,
des_key_schedule schedule,des_cblock *ivec,int enc);
void des_xcbc_encrypt(des_cblock *input,des_cblock *output,long length,
des_key_schedule schedule,des_cblock *ivec,
des_cblock *inw,des_cblock *outw,int enc);
void des_cfb_encrypt(unsigned char *in,unsigned char *out,int numbits,
long length,des_key_schedule schedule,des_cblock *ivec,int enc);
void des_ecb_encrypt(des_cblock *input,des_cblock *output,
des_key_schedule ks,int enc);
void des_encrypt(DES_LONG *data,des_key_schedule ks, int enc);
void des_encrypt2(DES_LONG *data,des_key_schedule ks, int enc);
void des_encrypt3(DES_LONG *data, des_key_schedule ks1,
des_key_schedule ks2, des_key_schedule ks3);
void des_decrypt3(DES_LONG *data, des_key_schedule ks1,
des_key_schedule ks2, des_key_schedule ks3);
void des_ede3_cbc_encrypt(des_cblock *input, des_cblock *output,
long length, des_key_schedule ks1, des_key_schedule ks2,
des_key_schedule ks3, des_cblock *ivec, int enc);
void des_ede3_cfb64_encrypt(unsigned char *in, unsigned char *out,
long length, des_key_schedule ks1, des_key_schedule ks2,
des_key_schedule ks3, des_cblock *ivec, int *num, int enc);
void des_ede3_ofb64_encrypt(unsigned char *in, unsigned char *out,
long length, des_key_schedule ks1, des_key_schedule ks2,
des_key_schedule ks3, des_cblock *ivec, int *num);
void des_xwhite_in2out(des_cblock (*des_key), des_cblock (*in_white),
des_cblock (*out_white));
int des_enc_read(int fd,char *buf,int len,des_key_schedule sched,
des_cblock *iv);
int des_enc_write(int fd,char *buf,int len,des_key_schedule sched,
des_cblock *iv);
char *des_fcrypt(const char *buf,const char *salt, char *ret);
#ifdef PERL5
char *des_crypt(const char *buf,const char *salt);
#else
/* some stupid compilers complain because I have declared char instead
* of const char */
#ifndef __KERNEL__
#ifdef HEADER_DES_LOCL_H
char *crypt(const char *buf,const char *salt);
#else /* HEADER_DES_LOCL_H */
char *crypt(void);
#endif /* HEADER_DES_LOCL_H */
#endif /* __KERNEL__ */
#endif /* PERL5 */
void des_ofb_encrypt(unsigned char *in,unsigned char *out,
int numbits,long length,des_key_schedule schedule,des_cblock *ivec);
void des_pcbc_encrypt(des_cblock *input,des_cblock *output,long length,
des_key_schedule schedule,des_cblock *ivec,int enc);
DES_LONG des_quad_cksum(des_cblock *input,des_cblock *output,
long length,int out_count,des_cblock *seed);
void des_random_seed(des_cblock key);
void des_random_key(des_cblock ret);
int des_read_password(des_cblock *key,char *prompt,int verify);
int des_read_2passwords(des_cblock *key1,des_cblock *key2,
char *prompt,int verify);
int des_read_pw_string(char *buf,int length,char *prompt,int verify);
void des_set_odd_parity(des_cblock *key);
int des_is_weak_key(des_cblock *key);
int des_set_key(des_cblock *key,des_key_schedule schedule);
int des_key_sched(des_cblock *key,des_key_schedule schedule);
void des_string_to_key(char *str,des_cblock *key);
void des_string_to_2keys(char *str,des_cblock *key1,des_cblock *key2);
void des_cfb64_encrypt(unsigned char *in, unsigned char *out, long length,
des_key_schedule schedule, des_cblock *ivec, int *num, int enc);
void des_ofb64_encrypt(unsigned char *in, unsigned char *out, long length,
des_key_schedule schedule, des_cblock *ivec, int *num);
int des_read_pw(char *buf, char *buff, int size, char *prompt, int verify);
/* Extra functions from Mark Murray <[email protected]> */
/* The following functions are not in the normal unix build or the
* SSLeay build. When using the SSLeay build, use RAND_seed()
* and RAND_bytes() instead. */
int des_new_random_key(des_cblock *key);
void des_init_random_number_generator(des_cblock *key);
void des_set_random_generator_seed(des_cblock *key);
void des_set_sequence_number(des_cblock new_sequence_number);
void des_generate_random_block(des_cblock *block);
#else
char *des_options();
void des_ecb3_encrypt();
DES_LONG des_cbc_cksum();
void des_cbc_encrypt();
void des_ncbc_encrypt();
void des_xcbc_encrypt();
void des_cfb_encrypt();
void des_ede3_cfb64_encrypt();
void des_ede3_ofb64_encrypt();
void des_ecb_encrypt();
void des_encrypt();
void des_encrypt2();
void des_encrypt3();
void des_decrypt3();
void des_ede3_cbc_encrypt();
int des_enc_read();
int des_enc_write();
char *des_fcrypt();
#ifdef PERL5
char *des_crypt();
#else
char *crypt();
#endif
void des_ofb_encrypt();
void des_pcbc_encrypt();
DES_LONG des_quad_cksum();
void des_random_seed();
void des_random_key();
int des_read_password();
int des_read_2passwords();
int des_read_pw_string();
void des_set_odd_parity();
int des_is_weak_key();
int des_set_key();
int des_key_sched();
void des_string_to_key();
void des_string_to_2keys();
void des_cfb64_encrypt();
void des_ofb64_encrypt();
int des_read_pw();
void des_xwhite_in2out();
/* Extra functions from Mark Murray <[email protected]> */
/* The following functions are not in the normal unix build or the
* SSLeay build. When using the SSLeay build, use RAND_seed()
* and RAND_bytes() instead. */
#ifdef FreeBSD
int des_new_random_key();
void des_init_random_number_generator();
void des_set_random_generator_seed();
void des_set_sequence_number();
void des_generate_random_block();
#endif
#endif
#ifdef __cplusplus
}
#endif
#endif
linux/include/freeswan.h
+477
View File
@@ -0,0 +1,477 @@
#ifndef _FREESWAN_H
/*
* header file for FreeS/WAN library functions
* Copyright (C) 1998, 1999, 2000 Henry Spencer.
* Copyright (C) 1999, 2000, 2001 Richard Guy Briggs
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: freeswan.h,v 1.2 2004/03/22 21:53:17 as Exp $
*/
#define _FREESWAN_H /* seen it, no need to see it again */
/*
* We've just got to have some datatypes defined... And annoyingly, just
* where we get them depends on whether we're in userland or not.
*/
#ifdef __KERNEL__
# include <linux/types.h>
# include <linux/in.h>
#else /* __KERNEL__ */
# include <stdio.h>
# include <netinet/in.h>
# define uint8_t u_int8_t
# define uint16_t u_int16_t
# define uint32_t u_int32_t
# define uint64_t u_int64_t
# define DEBUG_NO_STATIC static
#endif /* __KERNEL__ */
#include <freeswan/ipsec_param.h>
/*
* Grab the kernel version to see if we have NET_21, and therefore
* IPv6. Some of this is repeated from ipsec_kversions.h. Of course,
* we aren't really testing if the kernel has IPv6, but rather if the
* the include files do.
*/
#include <linux/version.h>
#ifndef KERNEL_VERSION
#define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,1,0)
#define NET_21
#endif
#ifndef IPPROTO_COMP
# define IPPROTO_COMP 108
#endif /* !IPPROTO_COMP */
#ifndef IPPROTO_INT
# define IPPROTO_INT 61
#endif /* !IPPROTO_INT */
#ifdef CONFIG_IPSEC_DEBUG
# define DEBUG_NO_STATIC
#else /* CONFIG_IPSEC_DEBUG */
# define DEBUG_NO_STATIC static
#endif /* CONFIG_IPSEC_DEBUG */
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL /* KERNEL ifdef */
#ifndef NAT_TRAVERSAL
#define NAT_TRAVERSAL
#endif
#endif
#ifdef NAT_TRAVERSAL
#define ESPINUDP_WITH_NON_IKE 1 /* draft-ietf-ipsec-nat-t-ike-00/01 */
#define ESPINUDP_WITH_NON_ESP 2 /* draft-ietf-ipsec-nat-t-ike-02 */
#endif
/*
* Basic data types for the address-handling functions.
* ip_address and ip_subnet are supposed to be opaque types; do not
* use their definitions directly, they are subject to change!
*/
/* first, some quick fakes in case we're on an old system with no IPv6 */
#ifndef s6_addr16
struct in6_addr {
union
{
__u8 u6_addr8[16];
__u16 u6_addr16[8];
__u32 u6_addr32[4];
} in6_u;
#define s6_addr in6_u.u6_addr8
#define s6_addr16 in6_u.u6_addr16
#define s6_addr32 in6_u.u6_addr32
};
struct sockaddr_in6 {
unsigned short int sin6_family; /* AF_INET6 */
__u16 sin6_port; /* Transport layer port # */
__u32 sin6_flowinfo; /* IPv6 flow information */
struct in6_addr sin6_addr; /* IPv6 address */
__u32 sin6_scope_id; /* scope id (new in RFC2553) */
};
#endif /* !s6_addr16 */
/* then the main types */
typedef struct {
union {
struct sockaddr_in v4;
struct sockaddr_in6 v6;
} u;
} ip_address;
typedef struct {
ip_address addr;
int maskbits;
} ip_subnet;
/* and the SA ID stuff */
#ifdef __KERNEL__
typedef __u32 ipsec_spi_t;
#else
typedef u_int32_t ipsec_spi_t;
#endif
typedef struct { /* to identify an SA, we need: */
ip_address dst; /* A. destination host */
ipsec_spi_t spi; /* B. 32-bit SPI, assigned by dest. host */
# define SPI_PASS 256 /* magic values... */
# define SPI_DROP 257 /* ...for use... */
# define SPI_REJECT 258 /* ...with SA_INT */
# define SPI_HOLD 259
# define SPI_TRAP 260
# define SPI_TRAPSUBNET 261
int proto; /* C. protocol */
# define SA_ESP 50 /* IPPROTO_ESP */
# define SA_AH 51 /* IPPROTO_AH */
# define SA_IPIP 4 /* IPPROTO_IPIP */
# define SA_COMP 108 /* IPPROTO_COMP */
# define SA_INT 61 /* IANA reserved for internal use */
} ip_said;
struct sa_id { /* old v4-only version */
struct in_addr dst;
ipsec_spi_t spi;
int proto;
};
/* misc */
typedef const char *err_t; /* error message, or NULL for success */
struct prng { /* pseudo-random-number-generator guts */
unsigned char sbox[256];
int i, j;
unsigned long count;
};
/*
* definitions for user space, taken from freeswan/ipsec_sa.h
*/
typedef uint32_t IPsecSAref_t;
#define IPSEC_SA_REF_FIELD_WIDTH (8 * sizeof(IPsecSAref_t))
#define IPsecSAref2NFmark(x) ((x) << (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
#define NFmark2IPsecSAref(x) ((x) >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
#define IPSEC_SAREF_NULL (~((IPsecSAref_t)0))
/* GCC magic for use in function definitions! */
#ifdef GCC_LINT
# define PRINTF_LIKE(n) __attribute__ ((format(printf, n, n+1)))
# define NEVER_RETURNS __attribute__ ((noreturn))
# define UNUSED __attribute__ ((unused))
# define BLANK_FORMAT " " /* GCC_LINT whines about empty formats */
#else
# define PRINTF_LIKE(n) /* ignore */
# define NEVER_RETURNS /* ignore */
# define UNUSED /* ignore */
# define BLANK_FORMAT ""
#endif
/*
* new IPv6-compatible functions
*/
/* text conversions */
err_t ttoul(const char *src, size_t srclen, int format, unsigned long *dst);
size_t ultot(unsigned long src, int format, char *buf, size_t buflen);
#define ULTOT_BUF (22+1) /* holds 64 bits in octal */
err_t ttoaddr(const char *src, size_t srclen, int af, ip_address *dst);
err_t tnatoaddr(const char *src, size_t srclen, int af, ip_address *dst);
size_t addrtot(const ip_address *src, int format, char *buf, size_t buflen);
/* RFC 1886 old IPv6 reverse-lookup format is the bulkiest */
#define ADDRTOT_BUF (32*2 + 3 + 1 + 3 + 1 + 1)
err_t ttosubnet(const char *src, size_t srclen, int af, ip_subnet *dst);
size_t subnettot(const ip_subnet *src, int format, char *buf, size_t buflen);
#define SUBNETTOT_BUF (ADDRTOT_BUF + 1 + 3)
err_t ttosa(const char *src, size_t srclen, ip_said *dst);
size_t satot(const ip_said *src, int format, char *bufptr, size_t buflen);
#define SATOT_BUF (5 + ULTOA_BUF + 1 + ADDRTOT_BUF)
err_t ttodata(const char *src, size_t srclen, int base, char *buf,
size_t buflen, size_t *needed);
err_t ttodatav(const char *src, size_t srclen, int base,
char *buf, size_t buflen, size_t *needed,
char *errp, size_t errlen, unsigned int flags);
#define TTODATAV_BUF 40 /* ttodatav's largest non-literal message */
#define TTODATAV_IGNORESPACE (1<<1) /* ignore spaces in base64 encodings*/
#define TTODATAV_SPACECOUNTS 0 /* do not ignore spaces in base64 */
size_t datatot(const char *src, size_t srclen, int format, char *buf,
size_t buflen);
size_t keyblobtoid(const unsigned char *src, size_t srclen, char *dst,
size_t dstlen);
size_t splitkeytoid(const unsigned char *e, size_t elen, const unsigned char *m,
size_t mlen, char *dst, size_t dstlen);
#define KEYID_BUF 10 /* up to 9 text digits plus NUL */
err_t ttoprotoport(char *src, size_t src_len, u_int8_t *proto, u_int16_t *port,
int *has_port_wildcard);
/* initializations */
void initsaid(const ip_address *addr, ipsec_spi_t spi, int proto, ip_said *dst);
err_t loopbackaddr(int af, ip_address *dst);
err_t unspecaddr(int af, ip_address *dst);
err_t anyaddr(int af, ip_address *dst);
err_t initaddr(const unsigned char *src, size_t srclen, int af, ip_address *dst);
err_t initsubnet(const ip_address *addr, int maskbits, int clash, ip_subnet *dst);
err_t addrtosubnet(const ip_address *addr, ip_subnet *dst);
/* misc. conversions and related */
err_t rangetosubnet(const ip_address *from, const ip_address *to, ip_subnet *dst);
int addrtypeof(const ip_address *src);
int subnettypeof(const ip_subnet *src);
size_t addrlenof(const ip_address *src);
size_t addrbytesptr(const ip_address *src, const unsigned char **dst);
size_t addrbytesof(const ip_address *src, unsigned char *dst, size_t dstlen);
int masktocount(const ip_address *src);
void networkof(const ip_subnet *src, ip_address *dst);
void maskof(const ip_subnet *src, ip_address *dst);
/* tests */
int sameaddr(const ip_address *a, const ip_address *b);
int addrcmp(const ip_address *a, const ip_address *b);
int samesubnet(const ip_subnet *a, const ip_subnet *b);
int addrinsubnet(const ip_address *a, const ip_subnet *s);
int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);
int subnetishost(const ip_subnet *s);
int samesaid(const ip_said *a, const ip_said *b);
int sameaddrtype(const ip_address *a, const ip_address *b);
int samesubnettype(const ip_subnet *a, const ip_subnet *b);
int isanyaddr(const ip_address *src);
int isunspecaddr(const ip_address *src);
int isloopbackaddr(const ip_address *src);
/* low-level grot */
int portof(const ip_address *src);
void setportof(int port, ip_address *dst);
struct sockaddr *sockaddrof(ip_address *src);
size_t sockaddrlenof(const ip_address *src);
/* PRNG */
void prng_init(struct prng *prng, const unsigned char *key, size_t keylen);
void prng_bytes(struct prng *prng, unsigned char *dst, size_t dstlen);
unsigned long prng_count(struct prng *prng);
void prng_final(struct prng *prng);
/* odds and ends */
const char *ipsec_version_code(void);
const char *ipsec_version_string(void);
const char **ipsec_copyright_notice(void);
const char *dns_string_rr(int rr, char *buf, int bufsize);
const char *dns_string_datetime(time_t seconds,
char *buf,
int bufsize);
/*
* old functions, to be deleted eventually
*/
/* unsigned long */
const char * /* NULL for success, else string literal */
atoul(
const char *src,
size_t srclen, /* 0 means strlen(src) */
int base, /* 0 means figure it out */
unsigned long *resultp
);
size_t /* space needed for full conversion */
ultoa(
unsigned long n,
int base,
char *dst,
size_t dstlen
);
#define ULTOA_BUF 21 /* just large enough for largest result, */
/* assuming 64-bit unsigned long! */
/* Internet addresses */
const char * /* NULL for success, else string literal */
atoaddr(
const char *src,
size_t srclen, /* 0 means strlen(src) */
struct in_addr *addr
);
size_t /* space needed for full conversion */
addrtoa(
struct in_addr addr,
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
#define ADDRTOA_BUF 16 /* just large enough for largest result */
/* subnets */
const char * /* NULL for success, else string literal */
atosubnet(
const char *src,
size_t srclen, /* 0 means strlen(src) */
struct in_addr *addr,
struct in_addr *mask
);
size_t /* space needed for full conversion */
subnettoa(
struct in_addr addr,
struct in_addr mask,
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
#define SUBNETTOA_BUF 32 /* large enough for worst case result */
/* ranges */
const char * /* NULL for success, else string literal */
atoasr(
const char *src,
size_t srclen, /* 0 means strlen(src) */
char *type, /* 'a', 's', 'r' */
struct in_addr *addrs /* two-element array */
);
size_t /* space needed for full conversion */
rangetoa(
struct in_addr *addrs, /* two-element array */
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
#define RANGETOA_BUF 34 /* large enough for worst case result */
/* data types for SA conversion functions */
/* SAs */
const char * /* NULL for success, else string literal */
atosa(
const char *src,
size_t srclen, /* 0 means strlen(src) */
struct sa_id *sa
);
size_t /* space needed for full conversion */
satoa(
struct sa_id sa,
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
#define SATOA_BUF (3+ULTOA_BUF+ADDRTOA_BUF)
/* generic data, e.g. keys */
const char * /* NULL for success, else string literal */
atobytes(
const char *src,
size_t srclen, /* 0 means strlen(src) */
char *dst,
size_t dstlen,
size_t *lenp /* NULL means don't bother telling me */
);
size_t /* 0 failure, else true size */
bytestoa(
const char *src,
size_t srclen,
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
/* old versions of generic-data functions; deprecated */
size_t /* 0 failure, else true size */
atodata(
const char *src,
size_t srclen, /* 0 means strlen(src) */
char *dst,
size_t dstlen
);
size_t /* 0 failure, else true size */
datatoa(
const char *src,
size_t srclen,
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
/* part extraction and special addresses */
struct in_addr
subnetof(
struct in_addr addr,
struct in_addr mask
);
struct in_addr
hostof(
struct in_addr addr,
struct in_addr mask
);
struct in_addr
broadcastof(
struct in_addr addr,
struct in_addr mask
);
/* mask handling */
int
goodmask(
struct in_addr mask
);
int
masktobits(
struct in_addr mask
);
struct in_addr
bitstomask(
int n
);
/*
* general utilities
*/
#ifndef __KERNEL__
/* option pickup from files (userland only because of use of FILE) */
const char *optionsfrom(const char *filename, int *argcp, char ***argvp,
int optind, FILE *errorreport);
#endif
/*
* Debugging levels for pfkey_lib_debug
*/
#define PF_KEY_DEBUG_PARSE_NONE 0
#define PF_KEY_DEBUG_PARSE_PROBLEM 1
#define PF_KEY_DEBUG_PARSE_STRUCT 2
#define PF_KEY_DEBUG_PARSE_FLOW 4
#define PF_KEY_DEBUG_PARSE_MAX 7
extern unsigned int pfkey_lib_debug; /* bits selecting what to report */
/*
* pluto and lwdnsq need to know the maximum size of the commands to,
* and replies from lwdnsq.
*/
#define LWDNSQ_CMDBUF_LEN 1024
#define LWDNSQ_RESULT_LEN_MAX 4096
#endif /* _FREESWAN_H */
linux/include/freeswan/ipcomp.h
+61
View File
@@ -0,0 +1,61 @@
/*
* IPCOMP zlib interface code.
* Copyright (C) 2000 Svenning Soerensen <[email protected]>
* Copyright (C) 2000, 2001 Richard Guy Briggs <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
RCSID $Id: ipcomp.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
/* SSS */
#ifndef _IPCOMP_H
#define _IPCOMP_H
/* Prefix all global deflate symbols with "ipcomp_" to avoid collisions with ppp_deflate & ext2comp */
#ifndef IPCOMP_PREFIX
#define IPCOMP_PREFIX
#endif /* IPCOMP_PREFIX */
#ifndef IPPROTO_COMP
#define IPPROTO_COMP 108
#endif /* IPPROTO_COMP */
#ifdef CONFIG_IPSEC_DEBUG
extern int sysctl_ipsec_debug_ipcomp;
#endif /* CONFIG_IPSEC_DEBUG */
struct ipcomphdr { /* IPCOMP header */
__u8 ipcomp_nh; /* Next header (protocol) */
__u8 ipcomp_flags; /* Reserved, must be 0 */
__u16 ipcomp_cpi; /* Compression Parameter Index */
};
extern struct inet_protocol comp_protocol;
extern int sysctl_ipsec_debug_ipcomp;
#define IPCOMP_UNCOMPRESSABLE 0x000000001
#define IPCOMP_COMPRESSIONERROR 0x000000002
#define IPCOMP_PARMERROR 0x000000004
#define IPCOMP_DECOMPRESSIONERROR 0x000000008
#define IPCOMP_ADAPT_INITIAL_TRIES 8
#define IPCOMP_ADAPT_INITIAL_SKIP 4
#define IPCOMP_ADAPT_SUBSEQ_TRIES 2
#define IPCOMP_ADAPT_SUBSEQ_SKIP 8
/* Function prototypes */
struct sk_buff *skb_compress(struct sk_buff *skb, struct ipsec_sa *ips, unsigned int *flags);
struct sk_buff *skb_decompress(struct sk_buff *skb, struct ipsec_sa *ips, unsigned int *flags);
#endif /* _IPCOMP_H */
linux/include/freeswan/ipsec_ah.h
+235
View File
@@ -0,0 +1,235 @@
/*
* Authentication Header declarations
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_ah.h,v 1.2 2004/03/22 21:53:18 as Exp $
*/
#include "ipsec_md5h.h"
#include "ipsec_sha1.h"
#ifndef IPPROTO_AH
#define IPPROTO_AH 51
#endif /* IPPROTO_AH */
#define AH_FLENGTH 12 /* size of fixed part */
#define AHMD5_KMAX 64 /* MD5 max 512 bits key */
#define AHMD5_AMAX 12 /* MD5 96 bits of authenticator */
#define AHMD596_KLEN 16 /* MD5 128 bits key */
#define AHSHA196_KLEN 20 /* SHA1 160 bits key */
#define AHMD596_ALEN 16 /* MD5 128 bits authentication length */
#define AHSHA196_ALEN 20 /* SHA1 160 bits authentication length */
#define AHMD596_BLKLEN 64 /* MD5 block length */
#define AHSHA196_BLKLEN 64 /* SHA1 block length */
#define AHSHA2_256_BLKLEN 64 /* SHA2-256 block length */
#define AHSHA2_384_BLKLEN 128 /* SHA2-384 block length (?) */
#define AHSHA2_512_BLKLEN 128 /* SHA2-512 block length */
#define AH_BLKLEN_MAX 128 /* keep up to date! */
#define AH_AMAX AHSHA196_ALEN /* keep up to date! */
#define AHHMAC_HASHLEN 12 /* authenticator length of 96bits */
#define AHHMAC_RPLLEN 4 /* 32 bit replay counter */
#define DB_AH_PKTRX 0x0001
#define DB_AH_PKTRX2 0x0002
#define DB_AH_DMP 0x0004
#define DB_AH_IPSA 0x0010
#define DB_AH_XF 0x0020
#define DB_AH_INAU 0x0040
#define DB_AH_REPLAY 0x0100
#ifdef __KERNEL__
/* General HMAC algorithm is described in RFC 2104 */
#define HMAC_IPAD 0x36
#define HMAC_OPAD 0x5C
struct md5_ctx {
MD5_CTX ictx; /* context after H(K XOR ipad) */
MD5_CTX octx; /* context after H(K XOR opad) */
};
struct sha1_ctx {
SHA1_CTX ictx; /* context after H(K XOR ipad) */
SHA1_CTX octx; /* context after H(K XOR opad) */
};
struct auth_alg {
void (*init)(void *ctx);
void (*update)(void *ctx, unsigned char *bytes, __u32 len);
void (*final)(unsigned char *hash, void *ctx);
int hashlen;
};
extern struct inet_protocol ah_protocol;
struct options;
extern int
ah_rcv(struct sk_buff *skb,
struct device *dev,
struct options *opt,
__u32 daddr,
unsigned short len,
__u32 saddr,
int redo,
struct inet_protocol *protocol);
struct ahhdr /* Generic AH header */
{
__u8 ah_nh; /* Next header (protocol) */
__u8 ah_hl; /* AH length, in 32-bit words */
__u16 ah_rv; /* reserved, must be 0 */
__u32 ah_spi; /* Security Parameters Index */
__u32 ah_rpl; /* Replay prevention */
__u8 ah_data[AHHMAC_HASHLEN];/* Authentication hash */
};
#define AH_BASIC_LEN 8 /* basic AH header is 8 bytes, nh,hl,rv,spi
* and the ah_hl, says how many bytes after that
* to cover. */
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_ah;
#endif /* CONFIG_IPSEC_DEBUG */
#endif /* __KERNEL__ */
/*
* $Log: ipsec_ah.h,v $
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.4.1 2004/03/16 09:48:18 as
* alg-0.8.1rc12 patch merged
*
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.20 2003/02/06 02:21:34 rgb
*
* Moved "struct auth_alg" from ipsec_rcv.c to ipsec_ah.h .
* Changed "struct ah" to "struct ahhdr" and "struct esp" to "struct esphdr".
* Removed "#ifdef INBOUND_POLICY_CHECK_eroute" dead code.
*
* Revision 1.19 2002/09/16 21:19:13 mcr
* fixes for west-ah-icmp-01 - length of AH header must be
* calculated properly, and next_header field properly copied.
*
* Revision 1.18 2002/05/14 02:37:02 rgb
* Change reference from _TDB to _IPSA.
*
* Revision 1.17 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_ah.h,v
*
* Revision 1.16 2002/02/20 01:27:06 rgb
* Ditched a pile of structs only used by the old Netlink interface.
*
* Revision 1.15 2001/12/11 02:35:57 rgb
* Change "struct net_device" to "struct device" for 2.2 compatibility.
*
* Revision 1.14 2001/11/26 09:23:47 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.13.2.1 2001/09/25 02:18:24 mcr
* replace "struct device" with "struct netdevice"
*
* Revision 1.13 2001/06/14 19:35:08 rgb
* Update copyright date.
*
* Revision 1.12 2000/09/12 03:21:20 rgb
* Cleared out unused htonq.
*
* Revision 1.11 2000/09/08 19:12:55 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.10 2000/01/21 06:13:10 rgb
* Tidied up spacing.
* Added macros for HMAC padding magic numbers.(kravietz)
*
* Revision 1.9 1999/12/07 18:16:23 rgb
* Fixed comments at end of #endif lines.
*
* Revision 1.8 1999/04/11 00:28:56 henry
* GPL boilerplate
*
* Revision 1.7 1999/04/06 04:54:25 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.6 1999/01/26 02:06:01 rgb
* Removed CONFIG_IPSEC_ALGO_SWITCH macro.
*
* Revision 1.5 1999/01/22 06:17:49 rgb
* Updated macro comments.
* Added context types to support algorithm switch code.
* 64-bit clean-up -- converting 'u long long' to __u64.
*
* Revision 1.4 1998/07/14 15:54:56 rgb
* Add #ifdef __KERNEL__ to protect kernel-only structures.
*
* Revision 1.3 1998/06/30 18:05:16 rgb
* Comment out references to htonq.
*
* Revision 1.2 1998/06/25 19:33:46 rgb
* Add prototype for protocol receive function.
* Rearrange for more logical layout.
*
* Revision 1.1 1998/06/18 21:27:43 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.4 1998/05/18 22:28:43 rgb
* Disable key printing facilities from /proc/net/ipsec_*.
*
* Revision 1.3 1998/04/21 21:29:07 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.2 1998/04/12 22:03:17 rgb
* Updated ESP-3DES-HMAC-MD5-96,
* ESP-DES-HMAC-MD5-96,
* AH-HMAC-MD5-96,
* AH-HMAC-SHA1-96 since Henry started freeswan cvs repository
* from old standards (RFC182[5-9] to new (as of March 1998) drafts.
*
* Fixed eroute references in /proc/net/ipsec*.
*
* Started to patch module unloading memory leaks in ipsec_netlink and
* radij tree unloading.
*
* Revision 1.1 1998/04/09 03:05:55 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* Added definitions for new AH transforms.
*
* Revision 0.3 1996/11/20 14:35:48 ji
* Minor Cleanup.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_alg.h
+254
View File
@@ -0,0 +1,254 @@
/*
* Modular extensions service and registration functions interface
*
* Author: JuanJo Ciarlante <[email protected]>
*
* $Id: ipsec_alg.h,v 1.2 2004/03/22 21:53:18 as Exp $
*
*/
/*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
*/
#ifndef IPSEC_ALG_H
#define IPSEC_ALG_H
/*
* gcc >= 3.2 has removed __FUNCTION__, replaced by C99 __func__
* *BUT* its a compiler variable.
*/
#if (__GNUC__ >= 3)
#ifndef __FUNCTION__
#define __FUNCTION__ __func__
#endif
#endif
/* Version 0.8.1-0 */
#define IPSEC_ALG_VERSION 0x00080100
#include <linux/types.h>
#include <linux/list.h>
#include <asm/atomic.h>
/*
* The following structs are used via pointers in ipsec_alg object to
* avoid ipsec_alg.h coupling with freeswan headers, thus simplifying
* module development
*/
struct ipsec_sa;
struct esp;
/**************************************
*
* Main registration object
*
*************************************/
#define IPSEC_ALG_VERSION_QUAD(v) \
(v>>24),((v>>16)&0xff),((v>>8)&0xff),(v&0xff)
/*
* Main ipsec_alg objects: "OOPrograming wannabe"
* Hierachy (carefully handled with _minimal_ cast'ing):
*
* ipsec_alg+
* +->ipsec_alg_enc (ixt_alg_type=SADB_EXT_SUPPORTED_ENCRYPT)
* +->ipsec_alg_auth (ixt_alg_type=SADB_EXT_SUPPORTED_AUTH)
*/
/***************************************************************
*
* INTERFACE object: struct ipsec_alg
*
***************************************************************/
/*
* common part for every struct ipsec_alg_*
* (sortof poor's man OOP)
*/
#define IPSEC_ALG_STRUCT_COMMON \
unsigned ixt_version; /* only allow this version (or 'near')*/ \
struct list_head ixt_list; /* dlinked list */ \
struct module *ixt_module; /* THIS_MODULE */ \
unsigned ixt_state; /* state flags */ \
atomic_t ixt_refcnt; /* ref. count when pointed from ipsec_sa */ \
char ixt_name[16]; /* descriptive short name, eg. "3des" */ \
void *ixt_data; /* private for algo implementation */ \
uint8_t ixt_blocksize; /* blocksize in bytes */ \
\
/* THIS IS A COPY of struct supported (lib/pfkey.h) \
* please keep in sync until we migrate 'supported' stuff \
* to ipsec_alg \
*/ \
uint16_t ixt_alg_type; /* correspond to IPSEC_ALG_{ENCRYPT,AUTH} */ \
uint8_t ixt_alg_id; /* enc. alg. number, eg. ESP_3DES */ \
uint8_t ixt_ivlen; /* ivlen in bits, expected to be multiple of 8! */ \
uint16_t ixt_keyminbits;/* min. keybits (of entropy) */ \
uint16_t ixt_keymaxbits;/* max. keybits (of entropy) */
#define ixt_support ixt_alg_type
#define IPSEC_ALG_ST_SUPP 0x01
#define IPSEC_ALG_ST_REGISTERED 0x02
#define IPSEC_ALG_ST_EXCL 0x04
struct ipsec_alg {
IPSEC_ALG_STRUCT_COMMON
};
/*
* Note the const in cbc_encrypt IV arg:
* some ciphers like to toast passed IV (eg. 3DES): make a local IV copy
*/
struct ipsec_alg_enc {
IPSEC_ALG_STRUCT_COMMON
unsigned ixt_e_keylen; /* raw key length in bytes */
unsigned ixt_e_ctx_size; /* sa_p->key_e_size */
int (*ixt_e_set_key)(struct ipsec_alg_enc *alg, __u8 *key_e, const __u8 *key, size_t keysize);
__u8 *(*ixt_e_new_key)(struct ipsec_alg_enc *alg, const __u8 *key, size_t keysize);
void (*ixt_e_destroy_key)(struct ipsec_alg_enc *alg, __u8 *key_e);
int (*ixt_e_cbc_encrypt)(struct ipsec_alg_enc *alg, __u8 *key_e, __u8 *in, int ilen, const __u8 *iv, int encrypt);
};
struct ipsec_alg_auth {
IPSEC_ALG_STRUCT_COMMON
unsigned ixt_a_keylen; /* raw key length in bytes */
unsigned ixt_a_ctx_size; /* sa_p->key_a_size */
unsigned ixt_a_authlen; /* 'natural' auth. hash len (bytes) */
int (*ixt_a_hmac_set_key)(struct ipsec_alg_auth *alg, __u8 *key_a, const __u8 *key, int keylen);
int (*ixt_a_hmac_hash)(struct ipsec_alg_auth *alg, __u8 *key_a, const __u8 *dat, int len, __u8 *hash, int hashlen);
};
/*
* These are _copies_ of SADB_EXT_SUPPORTED_{AUTH,ENCRYPT},
* to avoid header coupling for true constants
* about headers ... "cp is your friend" --Linus
*/
#define IPSEC_ALG_TYPE_AUTH 14
#define IPSEC_ALG_TYPE_ENCRYPT 15
/***************************************************************
*
* INTERFACE for module loading,testing, and unloading
*
***************************************************************/
/* - registration calls */
int register_ipsec_alg(struct ipsec_alg *);
int unregister_ipsec_alg(struct ipsec_alg *);
/* - optional (simple test) for algos */
int ipsec_alg_test(unsigned alg_type, unsigned alg_id, int testparm);
/* inline wrappers (usefull for type validation */
static inline int register_ipsec_alg_enc(struct ipsec_alg_enc *ixt) {
return register_ipsec_alg((struct ipsec_alg*)ixt);
}
static inline int unregister_ipsec_alg_enc(struct ipsec_alg_enc *ixt) {
return unregister_ipsec_alg((struct ipsec_alg*)ixt);
}
static inline int register_ipsec_alg_auth(struct ipsec_alg_auth *ixt) {
return register_ipsec_alg((struct ipsec_alg*)ixt);
}
static inline int unregister_ipsec_alg_auth(struct ipsec_alg_auth *ixt) {
return unregister_ipsec_alg((struct ipsec_alg*)ixt);
}
/*****************************************************************
*
* INTERFACE for ENC services: key creation, encrypt function
*
*****************************************************************/
#define IPSEC_ALG_ENCRYPT 1
#define IPSEC_ALG_DECRYPT 0
/* encryption key context creation function */
int ipsec_alg_enc_key_create(struct ipsec_sa *sa_p);
/*
* ipsec_alg_esp_encrypt(): encrypt ilen bytes in idat returns
* 0 or ERR<0
*/
int ipsec_alg_esp_encrypt(struct ipsec_sa *sa_p, __u8 *idat, int ilen, const __u8 *iv, int action);
/***************************************************************
*
* INTERFACE for AUTH services: key creation, hash functions
*
***************************************************************/
int ipsec_alg_auth_key_create(struct ipsec_sa *sa_p);
int ipsec_alg_sa_esp_hash(const struct ipsec_sa *sa_p, const __u8 *espp, int len, __u8 *hash, int hashlen) ;
#define ipsec_alg_sa_esp_update(c,k,l) ipsec_alg_sa_esp_hash(c,k,l,NULL,0)
/* only called from ipsec_init.c */
int ipsec_alg_init(void);
/* algo module glue for static algos */
void ipsec_alg_static_init(void);
typedef int (*ipsec_alg_init_func_t) (void);
/**********************************************
*
* INTERFACE for ipsec_sa init and wipe
*
**********************************************/
/* returns true if ipsec_sa has ipsec_alg obj attached */
/*
* Initializes ipsec_sa's ipsec_alg object, using already loaded
* proto, authalg, encalg.; links ipsec_alg objects (enc, auth)
*/
int ipsec_alg_sa_init(struct ipsec_sa *sa_p);
/*
* Destroys ipsec_sa's ipsec_alg object
* unlinking ipsec_alg objects
*/
int ipsec_alg_sa_wipe(struct ipsec_sa *sa_p);
/**********************************************
*
* 2.2 backport for some 2.4 useful module stuff
*
**********************************************/
#ifdef MODULE
#ifndef THIS_MODULE
#define THIS_MODULE (&__this_module)
#endif
#ifndef module_init
typedef int (*__init_module_func_t)(void);
typedef void (*__cleanup_module_func_t)(void);
#define module_init(x) \
int init_module(void) __attribute__((alias(#x))); \
static inline __init_module_func_t __init_module_inline(void) \
{ return x; }
#define module_exit(x) \
void cleanup_module(void) __attribute__((alias(#x))); \
static inline __cleanup_module_func_t __cleanup_module_inline(void) \
{ return x; }
#endif
#define IPSEC_ALG_MODULE_INIT( func_name ) \
static int func_name(void); \
module_init(func_name); \
static int __init func_name(void)
#define IPSEC_ALG_MODULE_EXIT( func_name ) \
static void func_name(void); \
module_exit(func_name); \
static void __exit func_name(void)
#else /* not MODULE */
#ifndef THIS_MODULE
#define THIS_MODULE NULL
#endif
/*
* I only want module_init() magic
* when algo.c file *is THE MODULE*, in all other
* cases, initialization is called explicitely from ipsec_alg_init()
*/
#define IPSEC_ALG_MODULE_INIT( func_name ) \
extern int func_name(void); \
int func_name(void)
#define IPSEC_ALG_MODULE_EXIT( func_name ) \
extern void func_name(void); \
void func_name(void)
#endif
#endif /* IPSEC_ALG_H */
linux/include/freeswan/ipsec_encap.h
+143
View File
@@ -0,0 +1,143 @@
/*
* declarations relevant to encapsulation-like operations
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_encap.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#ifndef _IPSEC_ENCAP_H_
#define SENT_IP4 16 /* data is two struct in_addr + proto + ports*/
/* (2 * sizeof(struct in_addr)) */
/* sizeof(struct sockaddr_encap)
- offsetof(struct sockaddr_encap, Sen.Sip4.Src) */
struct sockaddr_encap
{
__u8 sen_len; /* length */
__u8 sen_family; /* AF_ENCAP */
__u16 sen_type; /* see SENT_* */
union
{
struct /* SENT_IP4 */
{
struct in_addr Src;
struct in_addr Dst;
__u8 Proto;
__u16 Sport;
__u16 Dport;
} Sip4;
} Sen;
};
#define sen_ip_src Sen.Sip4.Src
#define sen_ip_dst Sen.Sip4.Dst
#define sen_proto Sen.Sip4.Proto
#define sen_sport Sen.Sip4.Sport
#define sen_dport Sen.Sip4.Dport
#ifndef AF_ENCAP
#define AF_ENCAP 26
#endif /* AF_ENCAP */
#define _IPSEC_ENCAP_H_
#endif /* _IPSEC_ENCAP_H_ */
/*
* $Log: ipsec_encap.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.17 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_encap.h,v
*
* Revision 1.16 2001/11/26 09:23:47 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.15.2.1 2001/09/25 02:18:54 mcr
* struct eroute moved to ipsec_eroute.h
*
* Revision 1.15 2001/09/14 16:58:36 rgb
* Added support for storing the first and last packets through a HOLD.
*
* Revision 1.14 2001/09/08 21:13:31 rgb
* Added pfkey ident extension support for ISAKMPd. (NetCelo)
*
* Revision 1.13 2001/06/14 19:35:08 rgb
* Update copyright date.
*
* Revision 1.12 2001/05/27 06:12:10 rgb
* Added structures for pid, packet count and last access time to eroute.
* Added packet count to beginning of /proc/net/ipsec_eroute.
*
* Revision 1.11 2000/09/08 19:12:56 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.10 2000/03/22 16:15:36 rgb
* Fixed renaming of dev_get (MB).
*
* Revision 1.9 2000/01/21 06:13:26 rgb
* Added a macro for AF_ENCAP
*
* Revision 1.8 1999/12/31 14:56:55 rgb
* MB fix for 2.3 dev-use-count.
*
* Revision 1.7 1999/11/18 04:09:18 rgb
* Replaced all kernel version macros to shorter, readable form.
*
* Revision 1.6 1999/09/24 00:34:13 rgb
* Add Marc Boucher's support for 2.3.xx+.
*
* Revision 1.5 1999/04/11 00:28:57 henry
* GPL boilerplate
*
* Revision 1.4 1999/04/06 04:54:25 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.3 1998/10/19 14:44:28 rgb
* Added inclusion of freeswan.h.
* sa_id structure implemented and used: now includes protocol.
*
* Revision 1.2 1998/07/14 18:19:33 rgb
* Added #ifdef __KERNEL__ directives to restrict scope of header.
*
* Revision 1.1 1998/06/18 21:27:44 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.2 1998/04/21 21:29:10 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.1 1998/04/09 03:05:58 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* Minor cosmetic changes.
*
* Revision 0.3 1996/11/20 14:35:48 ji
* Minor Cleanup.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_eroute.h
+103
View File
@@ -0,0 +1,103 @@
/*
* @(#) declarations of eroute structures
*
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs <[email protected]>
* Copyright (C) 2001 Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_eroute.h,v 1.1 2004/03/15 20:35:25 as Exp $
*
* derived from ipsec_encap.h 1.15 on 2001/9/18 by mcr.
*
*/
#ifndef _IPSEC_EROUTE_H_
#include "radij.h"
#include "ipsec_encap.h"
#include "ipsec_radij.h"
/*
* The "type" is really part of the address as far as the routing
* system is concerned. By using only one bit in the type field
* for each type, we sort-of make sure that different types of
* encapsulation addresses won't be matched against the wrong type.
*/
/*
* An entry in the radix tree
*/
struct rjtentry
{
struct radij_node rd_nodes[2]; /* tree glue, and other values */
#define rd_key(r) ((struct sockaddr_encap *)((r)->rd_nodes->rj_key))
#define rd_mask(r) ((struct sockaddr_encap *)((r)->rd_nodes->rj_mask))
short rd_flags;
short rd_count;
};
struct ident
{
__u16 type; /* identity type */
__u64 id; /* identity id */
__u8 len; /* identity len */
caddr_t data; /* identity data */
};
/*
* An encapsulation route consists of a pointer to a
* radix tree entry and a SAID (a destination_address/SPI/protocol triple).
*/
struct eroute
{
struct rjtentry er_rjt;
struct sa_id er_said;
uint32_t er_pid;
uint32_t er_count;
uint64_t er_lasttime;
struct sockaddr_encap er_eaddr; /* MCR get rid of _encap, it is silly*/
struct sockaddr_encap er_emask;
struct ident er_ident_s;
struct ident er_ident_d;
struct sk_buff* er_first;
struct sk_buff* er_last;
};
#define er_dst er_said.dst
#define er_spi er_said.spi
#define _IPSEC_EROUTE_H_
#endif /* _IPSEC_EROUTE_H_ */
/*
* $Log: ipsec_eroute.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.3 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_eroute.h,v
*
* Revision 1.2 2001/11/26 09:16:13 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.1.2.1 2001/09/25 02:18:54 mcr
* struct eroute moved to ipsec_eroute.h
*
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/
linux/include/freeswan/ipsec_errs.h
+53
View File
@@ -0,0 +1,53 @@
/*
* @(#) definition of ipsec_errs structure
*
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_errs.h,v 1.1 2004/03/15 20:35:25 as Exp $
*
*/
/*
* This file describes the errors/statistics that FreeSWAN collects.
*
*/
struct ipsec_errs {
__u32 ips_alg_errs; /* number of algorithm errors */
__u32 ips_auth_errs; /* # of authentication errors */
__u32 ips_encsize_errs; /* # of encryption size errors*/
__u32 ips_encpad_errs; /* # of encryption pad errors*/
__u32 ips_replaywin_errs; /* # of pkt sequence errors */
};
/*
* $Log: ipsec_errs.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.3 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_errs.h,v
*
* Revision 1.2 2001/11/26 09:16:13 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.1.2.1 2001/09/25 02:25:57 mcr
* lifetime structure created and common functions created.
*
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/
linux/include/freeswan/ipsec_esp.h
+220
View File
@@ -0,0 +1,220 @@
/*
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_esp.h,v 1.2 2004/03/22 21:53:18 as Exp $
*/
#include "freeswan/ipsec_md5h.h"
#include "freeswan/ipsec_sha1.h"
#include "crypto/des.h"
#ifndef IPPROTO_ESP
#define IPPROTO_ESP 50
#endif /* IPPROTO_ESP */
#define ESP_HEADER_LEN 8 /* 64 bits header (spi+rpl)*/
#define EMT_ESPDESCBC_ULEN 20 /* coming from user mode */
#define EMT_ESPDES_KMAX 64 /* 512 bit secret key enough? */
#define EMT_ESPDES_KEY_SZ 8 /* 56 bit secret key with parity = 64 bits */
#define EMT_ESP3DES_KEY_SZ 24 /* 168 bit secret key with parity = 192 bits */
#define EMT_ESPDES_IV_SZ 8 /* IV size */
#define ESP_DESCBC_BLKLEN 8 /* DES-CBC block size */
#define ESP_IV_MAXSZ 16 /* This is _critical_ */
#define ESP_IV_MAXSZ_INT (ESP_IV_MAXSZ/sizeof(int))
#define DB_ES_PKTRX 0x0001
#define DB_ES_PKTRX2 0x0002
#define DB_ES_IPSA 0x0010
#define DB_ES_XF 0x0020
#define DB_ES_IPAD 0x0040
#define DB_ES_INAU 0x0080
#define DB_ES_OINFO 0x0100
#define DB_ES_OINFO2 0x0200
#define DB_ES_OH 0x0400
#define DB_ES_REPLAY 0x0800
#ifdef __KERNEL__
struct des_eks {
des_key_schedule ks;
};
extern struct inet_protocol esp_protocol;
struct options;
extern int
esp_rcv(struct sk_buff *skb,
struct device *dev,
struct options *opt,
__u32 daddr,
unsigned short len,
__u32 saddr,
int redo,
struct inet_protocol *protocol);
/* Only for 64 bits IVs, eg. ESP_3DES :P */
struct esphdr
{
__u32 esp_spi; /* Security Parameters Index */
__u32 esp_rpl; /* Replay counter */
__u8 esp_iv[8]; /* iv */
};
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_esp;
#endif /* CONFIG_IPSEC_DEBUG */
#endif /* __KERNEL__ */
/*
* $Log: ipsec_esp.h,v $
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.4.1 2004/03/16 09:48:18 as
* alg-0.8.1rc12 patch merged
*
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.21 2003/02/06 02:21:34 rgb
*
* Moved "struct auth_alg" from ipsec_rcv.c to ipsec_ah.h .
* Changed "struct ah" to "struct ahhdr" and "struct esp" to "struct esphdr".
* Removed "#ifdef INBOUND_POLICY_CHECK_eroute" dead code.
*
* Revision 1.20 2002/05/14 02:37:02 rgb
* Change reference from _TDB to _IPSA.
*
* Revision 1.19 2002/04/24 07:55:32 mcr
* #include patches and Makefiles for post-reorg compilation.
*
* Revision 1.18 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_esp.h,v
*
* Revision 1.17 2002/02/20 01:27:07 rgb
* Ditched a pile of structs only used by the old Netlink interface.
*
* Revision 1.16 2001/12/11 02:35:57 rgb
* Change "struct net_device" to "struct device" for 2.2 compatibility.
*
* Revision 1.15 2001/11/26 09:23:48 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.14.2.3 2001/10/23 04:16:42 mcr
* get definition of des_key_schedule from des.h
*
* Revision 1.14.2.2 2001/10/22 20:33:13 mcr
* use "des_key_schedule" structure instead of cooking our own.
*
* Revision 1.14.2.1 2001/09/25 02:18:25 mcr
* replace "struct device" with "struct netdevice"
*
* Revision 1.14 2001/06/14 19:35:08 rgb
* Update copyright date.
*
* Revision 1.13 2000/09/08 19:12:56 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.12 2000/08/01 14:51:50 rgb
* Removed _all_ remaining traces of DES.
*
* Revision 1.11 2000/01/10 16:36:20 rgb
* Ditch last of EME option flags, including initiator.
*
* Revision 1.10 1999/12/07 18:16:22 rgb
* Fixed comments at end of #endif lines.
*
* Revision 1.9 1999/04/11 00:28:57 henry
* GPL boilerplate
*
* Revision 1.8 1999/04/06 04:54:25 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.7 1999/01/26 02:06:00 rgb
* Removed CONFIG_IPSEC_ALGO_SWITCH macro.
*
* Revision 1.6 1999/01/22 15:22:05 rgb
* Re-enable IV in the espblkrply_edata structure to avoid breaking pluto
* until pluto can be fixed properly.
*
* Revision 1.5 1999/01/22 06:18:16 rgb
* Updated macro comments.
* Added key schedule types to support algorithm switch code.
*
* Revision 1.4 1998/08/12 00:07:32 rgb
* Added data structures for new xforms: null, {,3}dessha1.
*
* Revision 1.3 1998/07/14 15:57:01 rgb
* Add #ifdef __KERNEL__ to protect kernel-only structures.
*
* Revision 1.2 1998/06/25 19:33:46 rgb
* Add prototype for protocol receive function.
* Rearrange for more logical layout.
*
* Revision 1.1 1998/06/18 21:27:45 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.6 1998/06/05 02:28:08 rgb
* Minor comment fix.
*
* Revision 1.5 1998/05/27 22:34:00 rgb
* Changed structures to accomodate key separation.
*
* Revision 1.4 1998/05/18 22:28:43 rgb
* Disable key printing facilities from /proc/net/ipsec_*.
*
* Revision 1.3 1998/04/21 21:29:07 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.2 1998/04/12 22:03:20 rgb
* Updated ESP-3DES-HMAC-MD5-96,
* ESP-DES-HMAC-MD5-96,
* AH-HMAC-MD5-96,
* AH-HMAC-SHA1-96 since Henry started freeswan cvs repository
* from old standards (RFC182[5-9] to new (as of March 1998) drafts.
*
* Fixed eroute references in /proc/net/ipsec*.
*
* Started to patch module unloading memory leaks in ipsec_netlink and
* radij tree unloading.
*
* Revision 1.1 1998/04/09 03:06:00 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.5 1997/06/03 04:24:48 ji
* Added ESP-3DES-MD5-96 transform.
*
* Revision 0.4 1997/01/15 01:28:15 ji
* Added definitions for new ESP transforms.
*
* Revision 0.3 1996/11/20 14:35:48 ji
* Minor Cleanup.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_ipe4.h
+68
View File
@@ -0,0 +1,68 @@
/*
* IP-in-IP Header declarations
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_ipe4.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
/* The packet header is an IP header! */
struct ipe4_xdata /* transform table data */
{
struct in_addr i4_src;
struct in_addr i4_dst;
};
#define EMT_IPE4_ULEN 8 /* coming from user mode */
/*
* $Log: ipsec_ipe4.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.5 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_ipe4.h,v
*
* Revision 1.4 2001/06/14 19:35:08 rgb
* Update copyright date.
*
* Revision 1.3 1999/04/11 00:28:57 henry
* GPL boilerplate
*
* Revision 1.2 1999/04/06 04:54:25 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.1 1998/06/18 21:27:47 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.1 1998/04/09 03:06:07 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:03 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* No changes.
*
* Revision 0.3 1996/11/20 14:48:53 ji
* Release update only.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_kversion.h
+227
View File
@@ -0,0 +1,227 @@
#ifndef _FREESWAN_KVERSIONS_H
/*
* header file for FreeS/WAN library functions
* Copyright (C) 1998, 1999, 2000 Henry Spencer.
* Copyright (C) 1999, 2000, 2001 Richard Guy Briggs
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: ipsec_kversion.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#define _FREESWAN_KVERSIONS_H /* seen it, no need to see it again */
/*
* this file contains a series of atomic defines that depend upon
* kernel version numbers. The kernel versions are arranged
* in version-order number (which is often not chronological)
* and each clause enables or disables a feature.
*/
/*
* First, assorted kernel-version-dependent trickery.
*/
#include <linux/version.h>
#ifndef KERNEL_VERSION
#define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
#endif
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,1,0)
#define HEADER_CACHE_BIND_21
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,1,0)
#define SPINLOCK
#define PROC_FS_21
#define NETLINK_SOCK
#define NET_21
#endif
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,1,19)
#define net_device_stats enet_statistics
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,0)
#define SPINLOCK_23
#define NETDEV_23
# ifndef CONFIG_IP_ALIAS
# define CONFIG_IP_ALIAS
# endif
#include <linux/socket.h>
#include <linux/skbuff.h>
#include <linux/netlink.h>
# ifdef NETLINK_XFRM
# define NETDEV_25
# endif
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,25)
#define PROC_FS_2325
#undef PROC_FS_21
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,30)
#define PROC_NO_DUMMY
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,35)
#define SKB_COPY_EXPAND
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,37)
#define IP_SELECT_IDENT
#endif
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,50)) && defined(CONFIG_NETFILTER)
#define SKB_RESET_NFCT
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,2)
#define IP_SELECT_IDENT_NEW
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4)
#define IPH_is_SKB_PULLED
#define SKB_COW_NEW
#define PROTO_HANDLER_SINGLE_PARM
#define IP_FRAGMENT_LINEARIZE 1
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4) */
# ifdef REDHAT_BOGOSITY
# define IP_SELECT_IDENT_NEW
# define IPH_is_SKB_PULLED
# define SKB_COW_NEW
# define PROTO_HANDLER_SINGLE_PARM
# endif /* REDHAT_BOGOSITY */
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4) */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,9)
#define MALLOC_SLAB
#define LINUX_KERNEL_HAS_SNPRINTF
#endif
#ifdef NET_21
# include <linux/in6.h>
#else
/* old kernel in.h has some IPv6 stuff, but not quite enough */
# define s6_addr16 s6_addr
# define AF_INET6 10
# define uint8_t __u8
# define uint16_t __u16
# define uint32_t __u32
# define uint64_t __u64
#endif
#ifdef NET_21
# define ipsec_kfree_skb(a) kfree_skb(a)
#else /* NET_21 */
# define ipsec_kfree_skb(a) kfree_skb(a, FREE_WRITE)
#endif /* NET_21 */
#ifdef NETDEV_23
# define device net_device
# define ipsec_dev_get dev_get_by_name
# define __ipsec_dev_get __dev_get_by_name
# define ipsec_dev_put(x) dev_put(x)
# define __ipsec_dev_put(x) __dev_put(x)
# define ipsec_dev_hold(x) dev_hold(x)
#else /* NETDEV_23 */
# define ipsec_dev_get dev_get
# define __ipsec_dev_put(x)
# define ipsec_dev_put(x)
# define ipsec_dev_hold(x)
#endif /* NETDEV_23 */
#ifndef SPINLOCK
# include <linux/bios32.h>
/* simulate spin locks and read/write locks */
typedef struct {
volatile char lock;
} spinlock_t;
typedef struct {
volatile unsigned int lock;
} rwlock_t;
# define spin_lock_init(x) { (x)->lock = 0;}
# define rw_lock_init(x) { (x)->lock = 0; }
# define spin_lock(x) { while ((x)->lock) barrier(); (x)->lock=1;}
# define spin_lock_irq(x) { cli(); spin_lock(x);}
# define spin_lock_irqsave(x,flags) { save_flags(flags); spin_lock_irq(x);}
# define spin_unlock(x) { (x)->lock=0;}
# define spin_unlock_irq(x) { spin_unlock(x); sti();}
# define spin_unlock_irqrestore(x,flags) { spin_unlock(x); restore_flags(flags);}
# define read_lock(x) spin_lock(x)
# define read_lock_irq(x) spin_lock_irq(x)
# define read_lock_irqsave(x,flags) spin_lock_irqsave(x,flags)
# define read_unlock(x) spin_unlock(x)
# define read_unlock_irq(x) spin_unlock_irq(x)
# define read_unlock_irqrestore(x,flags) spin_unlock_irqrestore(x,flags)
# define write_lock(x) spin_lock(x)
# define write_lock_irq(x) spin_lock_irq(x)
# define write_lock_irqsave(x,flags) spin_lock_irqsave(x,flags)
# define write_unlock(x) spin_unlock(x)
# define write_unlock_irq(x) spin_unlock_irq(x)
# define write_unlock_irqrestore(x,flags) spin_unlock_irqrestore(x,flags)
#endif /* !SPINLOCK */
#ifndef SPINLOCK_23
# define spin_lock_bh(x) spin_lock_irq(x)
# define spin_unlock_bh(x) spin_unlock_irq(x)
# define read_lock_bh(x) read_lock_irq(x)
# define read_unlock_bh(x) read_unlock_irq(x)
# define write_lock_bh(x) write_lock_irq(x)
# define write_unlock_bh(x) write_unlock_irq(x)
#endif /* !SPINLOCK_23 */
#endif /* _FREESWAN_KVERSIONS_H */
/*
* $Log: ipsec_kversion.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.7 2003/07/31 22:48:08 mcr
* derive NET25-ness from presence of NETLINK_XFRM macro.
*
* Revision 1.6 2003/06/24 20:22:32 mcr
* added new global: ipsecdevices[] so that we can keep track of
* the ipsecX devices. They will be referenced with dev_hold(),
* so 2.2 may need this as well.
*
* Revision 1.5 2003/04/03 17:38:09 rgb
* Centralised ipsec_kfree_skb and ipsec_dev_{get,put}.
*
* Revision 1.4 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_kversion.h,v
*
* Revision 1.3 2002/04/12 03:21:17 mcr
* three parameter version of ip_select_ident appears first
* in 2.4.2 (RH7.1) not 2.4.4.
*
* Revision 1.2 2002/03/08 21:35:22 rgb
* Defined LINUX_KERNEL_HAS_SNPRINTF to shut up compiler warnings after
* 2.4.9. (Andreas Piesk).
*
* Revision 1.1 2002/01/29 02:11:42 mcr
* removal of kversions.h - sources that needed it now use ipsec_param.h.
* updating of IPv6 structures to match latest in6.h version.
* removed dead code from freeswan.h that also duplicated kversions.h
* code.
*
*
*/
linux/include/freeswan/ipsec_life.h
+112
View File
@@ -0,0 +1,112 @@
/*
* Definitions relevant to IPSEC lifetimes
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_life.h,v 1.1 2004/03/15 20:35:25 as Exp $
*
* This file derived from ipsec_xform.h on 2001/9/18 by mcr.
*
*/
/*
* This file describes the book keeping fields for the
* IPsec Security Association Structure. ("ipsec_sa")
*
* This structure is never allocated directly by kernel code,
* (it is always a static/auto or is part of a structure)
* so it does not have a reference count.
*
*/
#ifndef _IPSEC_LIFE_H_
/*
* _count is total count.
* _hard is hard limit (kill SA after this number)
* _soft is soft limit (try to renew SA after this number)
* _last is used in some special cases.
*
*/
struct ipsec_lifetime64
{
__u64 ipl_count;
__u64 ipl_soft;
__u64 ipl_hard;
__u64 ipl_last;
};
struct ipsec_lifetimes
{
/* number of bytes processed */
struct ipsec_lifetime64 ipl_bytes;
/* number of packets processed */
struct ipsec_lifetime64 ipl_packets;
/* time since SA was added */
struct ipsec_lifetime64 ipl_addtime;
/* time since SA was first used */
struct ipsec_lifetime64 ipl_usetime;
/* from rfc2367:
* For CURRENT, the number of different connections,
* endpoints, or flows that the association has been
* allocated towards. For HARD and SOFT, the number of
* these the association may be allocated towards
* before it expires. The concept of a connection,
* flow, or endpoint is system specific.
*
* mcr(2001-9-18) it is unclear what purpose these serve for FreeSWAN.
* They are maintained for PF_KEY compatibility.
*/
struct ipsec_lifetime64 ipl_allocations;
};
enum ipsec_life_alive {
ipsec_life_harddied = -1,
ipsec_life_softdied = 0,
ipsec_life_okay = 1
};
enum ipsec_life_type {
ipsec_life_timebased = 1,
ipsec_life_countbased= 0
};
#define _IPSEC_LIFE_H_
#endif /* _IPSEC_LIFE_H_ */
/*
* $Log: ipsec_life.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.3 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_life.h,v
*
* Revision 1.2 2001/11/26 09:16:14 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.1.2.1 2001/09/25 02:25:58 mcr
* lifetime structure created and common functions created.
*
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/
linux/include/freeswan/ipsec_md5h.h
+140
View File
@@ -0,0 +1,140 @@
/*
* RCSID $Id: ipsec_md5h.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
/*
* The rest of this file is Copyright RSA DSI. See the following comments
* for the full Copyright notice.
*/
#ifndef _IPSEC_MD5H_H_
#define _IPSEC_MD5H_H_
/* GLOBAL.H - RSAREF types and constants
*/
/* PROTOTYPES should be set to one if and only if the compiler supports
function argument prototyping.
The following makes PROTOTYPES default to 0 if it has not already
been defined with C compiler flags.
*/
#ifndef PROTOTYPES
#define PROTOTYPES 1
#endif /* !PROTOTYPES */
/* POINTER defines a generic pointer type */
typedef __u8 *POINTER;
/* UINT2 defines a two byte word */
typedef __u16 UINT2;
/* UINT4 defines a four byte word */
typedef __u32 UINT4;
/* PROTO_LIST is defined depending on how PROTOTYPES is defined above.
If using PROTOTYPES, then PROTO_LIST returns the list, otherwise it
returns an empty list.
*/
#if PROTOTYPES
#define PROTO_LIST(list) list
#else /* PROTOTYPES */
#define PROTO_LIST(list) ()
#endif /* PROTOTYPES */
/* MD5.H - header file for MD5C.C
*/
/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
rights reserved.
License to copy and use this software is granted provided that it
is identified as the "RSA Data Security, Inc. MD5 Message-Digest
Algorithm" in all material mentioning or referencing this software
or this function.
License is also granted to make and use derivative works provided
that such works are identified as "derived from the RSA Data
Security, Inc. MD5 Message-Digest Algorithm" in all material
mentioning or referencing the derived work.
RSA Data Security, Inc. makes no representations concerning either
the merchantability of this software or the suitability of this
software for any particular purpose. It is provided "as is"
without express or implied warranty of any kind.
These notices must be retained in any copies of any part of this
documentation and/or software.
*/
/* MD5 context. */
typedef struct {
UINT4 state[4]; /* state (ABCD) */
UINT4 count[2]; /* number of bits, modulo 2^64 (lsb first) */
unsigned char buffer[64]; /* input buffer */
} MD5_CTX;
void MD5Init PROTO_LIST ((void *));
void MD5Update PROTO_LIST
((void *, unsigned char *, __u32));
void MD5Final PROTO_LIST ((unsigned char [16], void *));
#endif /* _IPSEC_MD5H_H_ */
/*
* $Log: ipsec_md5h.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.8 2002/09/10 01:45:09 mcr
* changed type of MD5_CTX and SHA1_CTX to void * so that
* the function prototypes would match, and could be placed
* into a pointer to a function.
*
* Revision 1.7 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_md5h.h,v
*
* Revision 1.6 1999/12/13 13:59:13 rgb
* Quick fix to argument size to Update bugs.
*
* Revision 1.5 1999/12/07 18:16:23 rgb
* Fixed comments at end of #endif lines.
*
* Revision 1.4 1999/04/06 04:54:26 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.3 1999/01/22 06:19:58 rgb
* 64-bit clean-up.
*
* Revision 1.2 1998/11/30 13:22:54 rgb
* Rationalised all the klips kernel file headers. They are much shorter
* now and won't conflict under RH5.2.
*
* Revision 1.1 1998/06/18 21:27:48 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.2 1998/04/23 20:54:03 rgb
* Fixed md5 and sha1 include file nesting issues, to be cleaned up when
* verified.
*
* Revision 1.1 1998/04/09 03:04:21 henry
* sources moved up from linux/net/ipsec
* these two include files modified not to include others except in kernel
*
* Revision 1.1.1.1 1998/04/08 05:35:03 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* No changes.
*
* Revision 0.3 1996/11/20 14:48:53 ji
* Release update only.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_param.h
+226
View File
@@ -0,0 +1,226 @@
/*
* @(#) FreeSWAN tunable paramaters
*
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_param.h,v 1.2 2004/04/28 08:07:11 as Exp $
*
*/
/*
* This file provides a set of #define's which may be tuned by various
* people/configurations. It keeps all compile-time tunables in one place.
*
* This file should be included before all other IPsec kernel-only files.
*
*/
#ifndef _IPSEC_PARAM_H_
#ifdef __KERNEL__
#include "ipsec_kversion.h"
/* Set number of ipsecX virtual devices here. */
/* This must be < exp(field width of IPSEC_DEV_FORMAT) */
/* It must also be reasonable so as not to overload the memory and CPU */
/* constraints of the host. */
#define IPSEC_NUM_IF 4
/* The field width must be < IF_NAM_SIZ - strlen("ipsec") - 1. */
/* With "ipsec" being 5 characters, that means 10 is the max field width */
/* but machine memory and CPU constraints are not likely to tollerate */
/* more than 3 digits. The default is one digit. */
/* Update: userland scripts get upset if they can't find "ipsec0", so */
/* for now, no "0"-padding should be used (which would have been helpful */
/* to make text-searches work */
#define IPSEC_DEV_FORMAT "ipsec%d"
/* For, say, 500 virtual ipsec devices, I would recommend: */
/* #define IPSEC_NUM_IF 500 */
/* #define IPSEC_DEV_FORMAT "ipsec%03d" */
/* Note that the "interfaces=" line in /etc/ipsec.conf would be, um, challenging. */
/* use dynamic ipsecX device allocation */
#ifndef CONFIG_IPSEC_DYNDEV
#define CONFIG_IPSEC_DYNDEV 1
#endif /* CONFIG_IPSEC_DYNDEV */
#ifdef CONFIG_IPSEC_BIGGATE
# define SADB_HASHMOD 8069
#else /* CONFIG_IPSEC_BIGGATE */
# define SADB_HASHMOD 257
#endif /* CONFIG_IPSEC_BIGGATE */
#endif /* __KERNEL__ */
/*
* This is for the SA reference table. This number is related to the
* maximum number of SAs that KLIPS can concurrently deal with, plus enough
* space for keeping expired SAs around.
*
* TABLE_MAX_WIDTH is the number of bits that we will use.
* MAIN_TABLE_WIDTH is the number of bits used for the primary index table.
*
*/
#ifndef IPSEC_SA_REF_TABLE_IDX_WIDTH
# define IPSEC_SA_REF_TABLE_IDX_WIDTH 16
#endif
#ifndef IPSEC_SA_REF_MAINTABLE_IDX_WIDTH
# define IPSEC_SA_REF_MAINTABLE_IDX_WIDTH 4
#endif
#ifndef IPSEC_SA_REF_FREELIST_NUM_ENTRIES
# define IPSEC_SA_REF_FREELIST_NUM_ENTRIES 256
#endif
#ifndef IPSEC_SA_REF_CODE
# define IPSEC_SA_REF_CODE 1
#endif
#ifdef __KERNEL__
/* This is defined for 2.4, but not 2.2.... */
#ifndef ARPHRD_VOID
# define ARPHRD_VOID 0xFFFF
#endif
/*
* Worry about PROC_FS stuff
*/
#if defined(PROC_FS_2325)
/* kernel 2.4 */
# define IPSEC_PROC_LAST_ARG ,int *eof,void *data
# define IPSEC_PROCFS_DEBUG_NO_STATIC
# define IPSEC_PROC_SUBDIRS
#else
/* kernel <2.4 */
# define IPSEC_PROCFS_DEBUG_NO_STATIC DEBUG_NO_STATIC
# ifndef PROC_NO_DUMMY
# define IPSEC_PROC_LAST_ARG , int dummy
# else
# define IPSEC_PROC_LAST_ARG
# endif /* !PROC_NO_DUMMY */
#endif /* PROC_FS_2325 */
#if !defined(LINUX_KERNEL_HAS_SNPRINTF)
/* GNU CPP specific! */
# define snprintf(buf, len, fmt...) sprintf(buf, ##fmt)
#endif /* !LINUX_KERNEL_HAS_SNPRINTF */
#ifdef SPINLOCK
# ifdef SPINLOCK_23
# include <linux/spinlock.h> /* *lock* */
# else /* SPINLOCK_23 */
# include <asm/spinlock.h> /* *lock* */
# endif /* SPINLOCK_23 */
#endif /* SPINLOCK */
#ifndef KLIPS_FIXES_DES_PARITY
# define KLIPS_FIXES_DES_PARITY 1
#endif /* !KLIPS_FIXES_DES_PARITY */
/* we don't really want to print these unless there are really big problems */
#ifndef KLIPS_DIVULGE_CYPHER_KEY
# define KLIPS_DIVULGE_CYPHER_KEY 0
#endif /* !KLIPS_DIVULGE_CYPHER_KEY */
#ifndef KLIPS_DIVULGE_HMAC_KEY
# define KLIPS_DIVULGE_HMAC_KEY 0
#endif /* !KLIPS_DIVULGE_HMAC_KEY */
#ifndef IPSEC_DISALLOW_IPOPTIONS
# define IPSEC_DISALLOW_IPOPTIONS 1
#endif /* !KLIPS_DIVULGE_HMAC_KEY */
/* extra toggles for regression testing */
#ifdef CONFIG_IPSEC_REGRESS
/*
* should pfkey_acquire() become 100% lossy?
*
*/
extern int sysctl_ipsec_regress_pfkey_lossage;
#ifndef KLIPS_PFKEY_ACQUIRE_LOSSAGE
# ifdef CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE
# define KLIPS_PFKEY_ACQUIRE_LOSSAGE 100
# else /* CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE */
/* not by default! */
# define KLIPS_PFKEY_ACQUIRE_LOSSAGE 0
# endif /* CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE */
#endif /* KLIPS_PFKEY_ACQUIRE_LOSSAGE */
#endif /* CONFIG_IPSEC_REGRESS */
/*
* debugging routines.
*/
#ifdef CONFIG_IPSEC_DEBUG
extern void ipsec_print_ip(struct iphdr *ip);
#define KLIPS_PRINT(flag, format, args...) \
((flag) ? printk(KERN_INFO format , ## args) : 0)
#define KLIPS_PRINTMORE(flag, format, args...) \
((flag) ? printk(format , ## args) : 0)
#define KLIPS_IP_PRINT(flag, ip) \
((flag) ? ipsec_print_ip(ip) : 0)
#else /* CONFIG_IPSEC_DEBUG */
#define KLIPS_PRINT(flag, format, args...) do ; while(0)
#define KLIPS_PRINTMORE(flag, format, args...) do ; while(0)
#define KLIPS_IP_PRINT(flag, ip) do ; while(0)
#endif /* CONFIG_IPSEC_DEBUG */
/*
* Stupid kernel API differences in APIs. Not only do some
* kernels not have ip_select_ident, but some have differing APIs,
* and SuSE has one with one parameter, but no way of checking to
* see what is really what.
*/
#ifdef SUSE_LINUX_2_4_19_IS_STUPID
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph)
#else
/* simplest case, nothing */
#if !defined(IP_SELECT_IDENT)
#define KLIPS_IP_SELECT_IDENT(iph, skb) do { iph->id = htons(ip_id_count++); } while(0)
#endif
/* kernels > 2.3.37-ish */
#if defined(IP_SELECT_IDENT) && !defined(IP_SELECT_IDENT_NEW)
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb->dst)
#endif
/* kernels > 2.4.2 */
#if defined(IP_SELECT_IDENT) && defined(IP_SELECT_IDENT_NEW)
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb->dst, NULL)
#endif
#endif /* SUSE_LINUX_2_4_19_IS_STUPID */
/*
* make klips fail test:east-espiv-01.
* exploit is at testing/attacks/espiv
*
*/
#define KLIPS_IMPAIRMENT_ESPIV_CBC_ATTACK 0
/* IP_FRAGMENT_LINEARIZE is set in freeswan.h if Kernel > 2.4.4 */
#ifndef IP_FRAGMENT_LINEARIZE
# define IP_FRAGMENT_LINEARIZE 0
#endif /* IP_FRAGMENT_LINEARIZE */
#endif /* __KERNEL__ */
#define _IPSEC_PARAM_H_
#endif /* _IPSEC_PARAM_H_ */
linux/include/freeswan/ipsec_policy.h
+225
View File
@@ -0,0 +1,225 @@
#ifndef _IPSEC_POLICY_H
/*
* policy interface file between pluto and applications
* Copyright (C) 2003 Michael Richardson <[email protected]>
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: ipsec_policy.h,v 1.4 2004/10/04 22:43:56 as Exp $
*/
#define _IPSEC_POLICY_H /* seen it, no need to see it again */
/*
* this file defines an interface between an application (or rather an
* application library) and a key/policy daemon. It provides for inquiries
* as to the current state of a connected socket, as well as for general
* questions.
*
* In general, the interface is defined as a series of functional interfaces,
* and the policy messages should be internal. However, because this is in
* fact an ABI between pieces of the system that may get compiled and revised
* seperately, this ABI must be public and revision controlled.
*
* It is expected that the daemon will always support previous versions.
*/
#define IPSEC_POLICY_MSG_REVISION (unsigned)200305061
enum ipsec_policy_command {
IPSEC_CMD_QUERY_FD = 1,
IPSEC_CMD_QUERY_HOSTPAIR = 2,
IPSEC_CMD_QUERY_DSTONLY = 3,
};
struct ipsec_policy_msg_head {
u_int32_t ipm_version;
u_int32_t ipm_msg_len;
u_int32_t ipm_msg_type;
u_int32_t ipm_msg_seq;
};
enum ipsec_privacy_quality {
IPSEC_PRIVACY_NONE = 0,
IPSEC_PRIVACY_INTEGRAL = 4, /* not private at all. AH-like */
IPSEC_PRIVACY_UNKNOWN = 8, /* something is claimed, but details unavail */
IPSEC_PRIVACY_ROT13 = 12, /* trivially breakable, i.e. 1DES */
IPSEC_PRIVACY_GAK = 16, /* known eavesdroppers */
IPSEC_PRIVACY_PRIVATE = 32, /* secure for at least a decade */
IPSEC_PRIVACY_STRONG = 64, /* ridiculously secure */
IPSEC_PRIVACY_TORTOISE = 192, /* even stronger, but very slow */
IPSEC_PRIVACY_OTP = 224, /* some kind of *true* one time pad */
};
enum ipsec_bandwidth_quality {
IPSEC_QOS_UNKNOWN = 0, /* unknown bandwidth */
IPSEC_QOS_INTERACTIVE = 16, /* reasonably moderate jitter, moderate fast.
Good enough for telnet/ssh. */
IPSEC_QOS_VOIP = 32, /* faster crypto, predicable jitter */
IPSEC_QOS_FTP = 64, /* higher throughput crypto, perhaps hardware
offloaded, but latency/jitter may be bad */
IPSEC_QOS_WIRESPEED = 128, /* expect to be able to fill your pipe */
};
/* moved from programs/pluto/constants.h */
/* IPsec AH transform values
* RFC2407 The Internet IP security Domain of Interpretation for ISAKMP 4.4.3
* and in http://www.iana.org/assignments/isakmp-registry
*/
enum ipsec_authentication_algo {
AH_NONE = 0,
AH_MD5 = 2,
AH_SHA = 3,
AH_DES = 4,
AH_SHA2_256 = 5,
AH_SHA2_384 = 6,
AH_SHA2_512 = 7,
AH_RIPEMD = 8
};
/* IPsec ESP transform values
* RFC2407 The Internet IP security Domain of Interpretation for ISAKMP 4.4.4
* and from http://www.iana.org/assignments/isakmp-registry
*/
enum ipsec_cipher_algo {
ESP_NONE = 0,
ESP_DES_IV64 = 1,
ESP_DES = 2,
ESP_3DES = 3,
ESP_RC5 = 4,
ESP_IDEA = 5,
ESP_CAST = 6,
ESP_BLOWFISH = 7,
ESP_3IDEA = 8,
ESP_DES_IV32 = 9,
ESP_RC4 = 10,
ESP_NULL = 11,
ESP_AES = 12,
ESP_AES_CTR = 13,
ESP_AES_CCM_8 = 14,
ESP_AES_CCM_12 = 15,
ESP_AES_CCM_16 = 16,
ESP_SERPENT = 252,
ESP_TWOFISH = 253
};
/* IPCOMP transform values
* RFC2407 The Internet IP security Domain of Interpretation for ISAKMP 4.4.5
*/
enum ipsec_comp_algo {
IPSCOMP_NONE = 0,
IPCOMP_OUI = 1,
IPCOMP_DEFLATE = 2,
IPCOMP_LZS = 3,
IPCOMP_LZJH = 4
};
/* Identification type values
* RFC 2407 The Internet IP security Domain of Interpretation for ISAKMP 4.6.2.1
*/
enum ipsec_id_type {
ID_IMPOSSIBLE= (-2), /* private to Pluto */
ID_MYID= (-1), /* private to Pluto */
ID_NONE= 0, /* private to Pluto */
ID_IPV4_ADDR= 1,
ID_FQDN= 2,
ID_USER_FQDN= 3,
ID_IPV4_ADDR_SUBNET= 4,
ID_IPV6_ADDR= 5,
ID_IPV6_ADDR_SUBNET= 6,
ID_IPV4_ADDR_RANGE= 7,
ID_IPV6_ADDR_RANGE= 8,
ID_DER_ASN1_DN= 9,
ID_DER_ASN1_GN= 10,
ID_KEY_ID= 11
};
/* Certificate type values
* RFC 2408 ISAKMP, chapter 3.9
*/
enum ipsec_cert_type {
CERT_NONE= 0,
CERT_PKCS7_WRAPPED_X509= 1, /* self-signed certificate from disk */
CERT_PGP= 2,
CERT_DNS_SIGNED_KEY= 3, /* KEY RR from DNS */
CERT_X509_SIGNATURE= 4,
CERT_X509_KEY_EXCHANGE= 5,
CERT_KERBEROS_TOKENS= 6,
CERT_CRL= 7,
CERT_ARL= 8,
CERT_SPKI= 9,
CERT_X509_ATTRIBUTE= 10,
CERT_RAW_RSA= 11, /* raw RSA from config file */
};
/* a SIG record in ASCII */
struct ipsec_dns_sig {
char fqdn[256];
char dns_sig[768]; /* empty string if not signed */
};
struct ipsec_raw_key {
char id_name[256];
char fs_keyid[8];
};
struct ipsec_identity {
enum ipsec_id_type ii_type;
enum ipsec_cert_type ii_format;
union {
struct ipsec_dns_sig ipsec_dns_signed;
/* some thing for PGP */
/* some thing for PKIX */
struct ipsec_raw_key ipsec_raw_key;
} ii_credential;
};
#define IPSEC_MAX_CREDENTIALS 32
struct ipsec_policy_cmd_query {
struct ipsec_policy_msg_head head;
/* Query section */
ip_address query_local; /* us */
ip_address query_remote; /* them */
u_short src_port, dst_port;
/* Answer section */
enum ipsec_privacy_quality strength;
enum ipsec_bandwidth_quality bandwidth;
enum ipsec_authentication_algo auth_detail;
enum ipsec_cipher_algo esp_detail;
enum ipsec_comp_algo comp_detail;
int credential_count;
struct ipsec_identity credentials[IPSEC_MAX_CREDENTIALS];
};
#define IPSEC_POLICY_SOCKET "/var/run/pluto.info"
/* prototypes */
extern err_t ipsec_policy_lookup(int fd, struct ipsec_policy_cmd_query *result);
extern err_t ipsec_policy_init(void);
extern err_t ipsec_policy_final(void);
extern err_t ipsec_policy_readmsg(int policysock,
unsigned char *buf, size_t buflen);
extern err_t ipsec_policy_sendrecv(unsigned char *buf, size_t buflen);
extern err_t ipsec_policy_cgilookup(struct ipsec_policy_cmd_query *result);
extern const char *ipsec_policy_version_code(void);
extern const char *ipsec_policy_version_string(void);
#endif /* _IPSEC_POLICY_H */
linux/include/freeswan/ipsec_proto.h
+111
View File
@@ -0,0 +1,111 @@
/*
* @(#) prototypes for FreeSWAN functions
*
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_proto.h,v 1.3 2004/06/13 19:55:14 as Exp $
*
*/
#ifndef _IPSEC_PROTO_H_
#include "ipsec_param.h"
/*
* This file is a kernel only file that declares prototypes for
* all intra-module function calls and global data structures.
*
* Include this file last.
*
*/
/* ipsec_init.c */
extern struct prng ipsec_prng;
/* ipsec_sa.c */
extern struct ipsec_sa *ipsec_sadb_hash[SADB_HASHMOD];
extern spinlock_t tdb_lock;
extern int ipsec_sadb_init(void);
extern struct ipsec_sa *ipsec_sa_getbyid(struct sa_id*);
extern int ipsec_sa_put(struct ipsec_sa *);
extern /* void */ int ipsec_sa_del(struct ipsec_sa *);
extern /* void */ int ipsec_sa_delchain(struct ipsec_sa *);
extern /* void */ int ipsec_sa_add(struct ipsec_sa *);
extern int ipsec_sadb_cleanup(__u8);
extern int ipsec_sa_wipe(struct ipsec_sa *);
/* debug declarations */
/* ipsec_proc.c */
extern int ipsec_proc_init(void);
extern void ipsec_proc_cleanup(void);
/* ipsec_radij.c */
extern int ipsec_makeroute(struct sockaddr_encap *ea,
struct sockaddr_encap *em,
struct sa_id said,
uint32_t pid,
struct sk_buff *skb,
struct ident *ident_s,
struct ident *ident_d);
extern int ipsec_breakroute(struct sockaddr_encap *ea,
struct sockaddr_encap *em,
struct sk_buff **first,
struct sk_buff **last);
int ipsec_radijinit(void);
int ipsec_cleareroutes(void);
int ipsec_radijcleanup(void);
/* ipsec_life.c */
extern enum ipsec_life_alive ipsec_lifetime_check(struct ipsec_lifetime64 *il64,
const char *lifename,
const char *saname,
enum ipsec_life_type ilt,
enum ipsec_direction idir,
struct ipsec_sa *ips);
extern int ipsec_lifetime_format(char *buffer,
int buflen,
char *lifename,
enum ipsec_life_type timebaselife,
struct ipsec_lifetime64 *lifetime);
extern void ipsec_lifetime_update_hard(struct ipsec_lifetime64 *lifetime,
__u64 newvalue);
extern void ipsec_lifetime_update_soft(struct ipsec_lifetime64 *lifetime,
__u64 newvalue);
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_xform;
extern int debug_eroute;
extern int debug_spi;
extern int debug_netlink;
#endif /* CONFIG_IPSEC_DEBUG */
#define _IPSEC_PROTO_H
#endif /* _IPSEC_PROTO_H_ */
linux/include/freeswan/ipsec_radij.h
+63
View File
@@ -0,0 +1,63 @@
/*
* @(#) Definitions relevant to the IPSEC <> radij tree interfacing
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_radij.h,v 1.3 2004/04/28 05:44:29 as Exp $
*/
#ifndef _IPSEC_RADIJ_H
#include <freeswan.h>
int ipsec_walk(char *);
int ipsec_rj_walker_procprint(struct radij_node *, void *);
int ipsec_rj_walker_delete(struct radij_node *, void *);
/* This structure is used to pass information between
* ipsec_eroute_get_info and ipsec_rj_walker_procprint
* (through rj_walktree) and between calls of ipsec_rj_walker_procprint.
*/
struct wsbuf
{
/* from caller of ipsec_eroute_get_info: */
char *const buffer; /* start of buffer provided */
const int length; /* length of buffer provided */
const off_t offset; /* file position of first character of interest */
/* accumulated by ipsec_rj_walker_procprint: */
int len; /* number of character filled into buffer */
off_t begin; /* file position contained in buffer[0] (<=offset) */
};
extern struct radij_node_head *rnh;
extern spinlock_t eroute_lock;
struct eroute * ipsec_findroute(struct sockaddr_encap *);
#define O1(x) (int)(((x)>>24)&0xff)
#define O2(x) (int)(((x)>>16)&0xff)
#define O3(x) (int)(((x)>>8)&0xff)
#define O4(x) (int)(((x))&0xff)
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_radij;
void rj_dumptrees(void);
#define DB_RJ_DUMPTREES 0x0001
#define DB_RJ_FINDROUTE 0x0002
#endif /* CONFIG_IPSEC_DEBUG */
#define _IPSEC_RADIJ_H
#endif
linux/include/freeswan/ipsec_rcv.h
+196
View File
@@ -0,0 +1,196 @@
/*
*
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_rcv.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#define DB_RX_PKTRX 0x0001
#define DB_RX_PKTRX2 0x0002
#define DB_RX_DMP 0x0004
#define DB_RX_IPSA 0x0010
#define DB_RX_XF 0x0020
#define DB_RX_IPAD 0x0040
#define DB_RX_INAU 0x0080
#define DB_RX_OINFO 0x0100
#define DB_RX_OINFO2 0x0200
#define DB_RX_OH 0x0400
#define DB_RX_REPLAY 0x0800
#ifdef __KERNEL__
/* struct options; */
#define __NO_VERSION__
#include <linux/module.h>
#include <linux/config.h> /* for CONFIG_IP_FORWARD */
#include <linux/version.h>
#include <freeswan.h>
#define IPSEC_BIRTH_TEMPLATE_MAXLEN 256
struct ipsec_birth_reply {
int packet_template_len;
unsigned char packet_template[IPSEC_BIRTH_TEMPLATE_MAXLEN];
};
extern struct ipsec_birth_reply ipsec_ipv4_birth_packet;
extern struct ipsec_birth_reply ipsec_ipv6_birth_packet;
extern int
#ifdef PROTO_HANDLER_SINGLE_PARM
ipsec_rcv(struct sk_buff *skb);
#else /* PROTO_HANDLER_SINGLE_PARM */
ipsec_rcv(struct sk_buff *skb,
#ifdef NET_21
unsigned short xlen);
#else /* NET_21 */
struct device *dev,
struct options *opt,
__u32 daddr,
unsigned short len,
__u32 saddr,
int redo,
struct inet_protocol *protocol);
#endif /* NET_21 */
#endif /* PROTO_HANDLER_SINGLE_PARM */
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_rcv;
#endif /* CONFIG_IPSEC_DEBUG */
extern int sysctl_ipsec_inbound_policy_check;
#endif /* __KERNEL__ */
/*
* $Log: ipsec_rcv.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.17 2002/09/03 16:32:32 mcr
* definitions of ipsec_birth_reply.
*
* Revision 1.16 2002/05/14 02:36:00 rgb
* Change references to _TDB to _IPSA.
*
* Revision 1.15 2002/04/24 07:36:47 mcr
* Moved from ./klips/net/ipsec/ipsec_rcv.h,v
*
* Revision 1.14 2001/09/07 22:15:48 rgb
* Fix for removal of transport layer protocol handler arg in 2.4.4.
*
* Revision 1.13 2001/06/14 19:35:09 rgb
* Update copyright date.
*
* Revision 1.12 2001/03/16 07:36:44 rgb
* Fixed #endif comment to sate compiler.
*
* Revision 1.11 2000/09/21 04:34:21 rgb
* Moved declaration of sysctl_ipsec_inbound_policy_check outside
* CONFIG_IPSEC_DEBUG. (MB)
*
* Revision 1.10 2000/09/18 02:36:10 rgb
* Exported sysctl_ipsec_inbound_policy_check for skb_decompress().
*
* Revision 1.9 2000/09/08 19:12:56 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.8 1999/11/18 04:09:19 rgb
* Replaced all kernel version macros to shorter, readable form.
*
* Revision 1.7 1999/05/25 01:45:37 rgb
* Fix version macros for 2.0.x as a module.
*
* Revision 1.6 1999/05/08 21:24:27 rgb
* Add includes for 2.2.x include into net/ipv4/protocol.c
*
* Revision 1.5 1999/05/05 22:02:32 rgb
* Add a quick and dirty port to 2.2 kernels by Marc Boucher <[email protected]>.
*
* Revision 1.4 1999/04/11 00:28:59 henry
* GPL boilerplate
*
* Revision 1.3 1999/04/06 04:54:27 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.2 1999/01/22 20:06:59 rgb
* Fixed cut-and-paste error from ipsec_esp.h.
*
* Revision 1.1 1999/01/21 20:29:12 rgb
* Converted from transform switching to algorithm switching.
*
* Log: ipsec_esp.h,v
* Revision 1.4 1998/08/12 00:07:32 rgb
* Added data structures for new xforms: null, {,3}dessha1.
*
* Revision 1.3 1998/07/14 15:57:01 rgb
* Add #ifdef __KERNEL__ to protect kernel-only structures.
*
* Revision 1.2 1998/06/25 19:33:46 rgb
* Add prototype for protocol receive function.
* Rearrange for more logical layout.
*
* Revision 1.1 1998/06/18 21:27:45 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.6 1998/06/05 02:28:08 rgb
* Minor comment fix.
*
* Revision 1.5 1998/05/27 22:34:00 rgb
* Changed structures to accomodate key separation.
*
* Revision 1.4 1998/05/18 22:28:43 rgb
* Disable key printing facilities from /proc/net/ipsec_*.
*
* Revision 1.3 1998/04/21 21:29:07 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.2 1998/04/12 22:03:20 rgb
* Updated ESP-3DES-HMAC-MD5-96,
* ESP-DES-HMAC-MD5-96,
* AH-HMAC-MD5-96,
* AH-HMAC-SHA1-96 since Henry started freeswan cvs repository
* from old standards (RFC182[5-9] to new (as of March 1998) drafts.
*
* Fixed eroute references in /proc/net/ipsec*.
*
* Started to patch module unloading memory leaks in ipsec_netlink and
* radij tree unloading.
*
* Revision 1.1 1998/04/09 03:06:00 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.5 1997/06/03 04:24:48 ji
* Added ESP-3DES-MD5-96 transform.
*
* Revision 0.4 1997/01/15 01:28:15 ji
* Added definitions for new ESP transforms.
*
* Revision 0.3 1996/11/20 14:35:48 ji
* Minor Cleanup.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_sa.h
+338
View File
@@ -0,0 +1,338 @@
/*
* @(#) Definitions of IPsec Security Association (ipsec_sa)
*
* Copyright (C) 2001, 2002, 2003
* Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_sa.h,v 1.3 2004/04/28 08:07:11 as Exp $
*
* This file derived from ipsec_xform.h on 2001/9/18 by mcr.
*
*/
/*
* This file describes the IPsec Security Association Structure.
*
* This structure keeps track of a single transform that may be done
* to a set of packets. It can describe applying the transform or
* apply the reverse. (e.g. compression vs expansion). However, it
* only describes one at a time. To describe both, two structures would
* be used, but since the sides of the transform are performed
* on different machines typically it is usual to have only one side
* of each association.
*
*/
#ifndef _IPSEC_SA_H_
#ifdef __KERNEL__
#include "ipsec_stats.h"
#include "ipsec_life.h"
#include "ipsec_eroute.h"
#endif /* __KERNEL__ */
#include "ipsec_param.h"
/* SAs are held in a table.
* Entries in this table are referenced by IPsecSAref_t values.
* IPsecSAref_t values are conceptually subscripts. Because
* we want to allocate the table piece-meal, the subscripting
* is implemented with two levels, a bit like paged virtual memory.
* This representation mechanism is known as an Iliffe Vector.
*
* The Main table (AKA the refTable) consists of 2^IPSEC_SA_REF_MAINTABLE_IDX_WIDTH
* pointers to subtables.
* Each subtable has 2^IPSEC_SA_REF_SUBTABLE_IDX_WIDTH entries, each of which
* is a pointer to an SA.
*
* An IPsecSAref_t contains either an exceptional value (signified by the
* high-order bit being on) or a reference to a table entry. A table entry
* reference has the subtable subscript in the low-order
* IPSEC_SA_REF_SUBTABLE_IDX_WIDTH bits and the Main table subscript
* in the next lowest IPSEC_SA_REF_MAINTABLE_IDX_WIDTH bits.
*
* The Maintable entry for an IPsecSAref_t x, a pointer to its subtable, is
* IPsecSAref2table(x). It is of type struct IPsecSArefSubTable *.
*
* The pointer to the SA for x is IPsecSAref2SA(x). It is of type
* struct ipsec_sa*. The macro definition clearly shows the two-level
* access needed to find the SA pointer.
*
* The Maintable is allocated when IPsec is initialized.
* Each subtable is allocated when needed, but the first is allocated
* when IPsec is initialized.
*
* IPsecSAref_t is designed to be smaller than an NFmark so that
* they can be stored in NFmarks and still leave a few bits for other
* purposes. The spare bits are in the low order of the NFmark
* but in the high order of the IPsecSAref_t, so conversion is required.
* We pick the upper bits of NFmark on the theory that they are less likely to
* interfere with more pedestrian uses of nfmark.
*/
typedef unsigned short int IPsecRefTableUnusedCount;
#define IPSEC_SA_REF_TABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_TABLE_IDX_WIDTH)
#ifdef __KERNEL__
#if ((IPSEC_SA_REF_TABLE_IDX_WIDTH - (1 + IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)) < 0)
#error "IPSEC_SA_REF_TABLE_IDX_WIDTH("IPSEC_SA_REF_TABLE_IDX_WIDTH") MUST be < 1 + IPSEC_SA_REF_MAINTABLE_IDX_WIDTH("IPSEC_SA_REF_MAINTABLE_IDX_WIDTH")"
#endif
#define IPSEC_SA_REF_SUBTABLE_IDX_WIDTH (IPSEC_SA_REF_TABLE_IDX_WIDTH - IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)
#define IPSEC_SA_REF_MAINTABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)
#define IPSEC_SA_REF_SUBTABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
#ifdef CONFIG_NETFILTER
#define IPSEC_SA_REF_HOST_FIELD(x) ((struct sk_buff*)(x))->nfmark
#define IPSEC_SA_REF_HOST_FIELD_TYPE typeof(IPSEC_SA_REF_HOST_FIELD(NULL))
#else /* CONFIG_NETFILTER */
/* just make it work for now, it doesn't matter, since there is no nfmark */
#define IPSEC_SA_REF_HOST_FIELD_TYPE unsigned long
#endif /* CONFIG_NETFILTER */
#define IPSEC_SA_REF_HOST_FIELD_WIDTH (8 * sizeof(IPSEC_SA_REF_HOST_FIELD_TYPE))
#define IPSEC_SA_REF_FIELD_WIDTH (8 * sizeof(IPsecSAref_t))
#define IPSEC_SA_REF_MASK (IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
#define IPSEC_SA_REF_TABLE_MASK ((IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)) << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
#define IPSEC_SA_REF_ENTRY_MASK (IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_SUBTABLE_IDX_WIDTH))
#define IPsecSAref2table(x) (((x) & IPSEC_SA_REF_TABLE_MASK) >> IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
#define IPsecSAref2entry(x) ((x) & IPSEC_SA_REF_ENTRY_MASK)
#define IPsecSArefBuild(x,y) (((x) << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH) + (y))
#define IPsecSAref2SA(x) (ipsec_sadb.refTable[IPsecSAref2table(x)]->entry[IPsecSAref2entry(x)])
#define IPsecSA2SAref(x) ((x)->ips_ref)
#define EMT_INBOUND 0x01 /* SA direction, 1=inbound */
/* 'struct ipsec_sa' should be 64bit aligned when allocated. */
struct ipsec_sa
{
IPsecSAref_t ips_ref; /* reference table entry number */
atomic_t ips_refcount; /* reference count for this struct */
struct ipsec_sa *ips_hnext; /* next in hash chain */
struct ipsec_sa *ips_inext; /* pointer to next xform */
struct ipsec_sa *ips_onext; /* pointer to prev xform */
struct ifnet *ips_rcvif; /* related rcv encap interface */
struct sa_id ips_said; /* SA ID */
__u32 ips_seq; /* seq num of msg that initiated this SA */
__u32 ips_pid; /* PID of process that initiated this SA */
__u8 ips_authalg; /* auth algorithm for this SA */
__u8 ips_encalg; /* enc algorithm for this SA */
struct ipsec_stats ips_errs;
__u8 ips_replaywin; /* replay window size */
__u8 ips_state; /* state of SA */
__u32 ips_replaywin_lastseq; /* last pkt sequence num */
__u64 ips_replaywin_bitmap; /* bitmap of received pkts */
__u32 ips_replaywin_maxdiff; /* max pkt sequence difference */
__u32 ips_flags; /* generic xform flags */
struct ipsec_lifetimes ips_life; /* lifetime records */
/* selector information */
struct sockaddr*ips_addr_s; /* src sockaddr */
struct sockaddr*ips_addr_d; /* dst sockaddr */
struct sockaddr*ips_addr_p; /* proxy sockaddr */
__u16 ips_addr_s_size;
__u16 ips_addr_d_size;
__u16 ips_addr_p_size;
ip_address ips_flow_s;
ip_address ips_flow_d;
ip_address ips_mask_s;
ip_address ips_mask_d;
__u16 ips_key_bits_a; /* size of authkey in bits */
__u16 ips_auth_bits; /* size of authenticator in bits */
__u16 ips_key_bits_e; /* size of enckey in bits */
__u16 ips_iv_bits; /* size of IV in bits */
__u8 ips_iv_size;
__u16 ips_key_a_size;
__u16 ips_key_e_size;
caddr_t ips_key_a; /* authentication key */
caddr_t ips_key_e; /* encryption key */
caddr_t ips_iv; /* Initialisation Vector */
struct ident ips_ident_s; /* identity src */
struct ident ips_ident_d; /* identity dst */
#ifdef CONFIG_IPSEC_IPCOMP
__u16 ips_comp_adapt_tries; /* ipcomp self-adaption tries */
__u16 ips_comp_adapt_skip; /* ipcomp self-adaption to-skip */
__u64 ips_comp_ratio_cbytes; /* compressed bytes */
__u64 ips_comp_ratio_dbytes; /* decompressed (or uncompressed) bytes */
#endif /* CONFIG_IPSEC_IPCOMP */
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
__u8 ips_natt_type;
__u8 ips_natt_reserved[3];
__u16 ips_natt_sport;
__u16 ips_natt_dport;
struct sockaddr *ips_natt_oa;
__u16 ips_natt_oa_size;
__u16 ips_natt_reserved2;
#endif
#if 0
__u32 ips_sens_dpd;
__u8 ips_sens_sens_level;
__u8 ips_sens_sens_len;
__u64* ips_sens_sens_bitmap;
__u8 ips_sens_integ_level;
__u8 ips_sens_integ_len;
__u64* ips_sens_integ_bitmap;
#endif
struct ipsec_alg_enc *ips_alg_enc;
struct ipsec_alg_auth *ips_alg_auth;
IPsecSAref_t ips_ref_rel;
};
struct IPsecSArefSubTable
{
struct ipsec_sa* entry[IPSEC_SA_REF_SUBTABLE_NUM_ENTRIES];
};
struct ipsec_sadb {
struct IPsecSArefSubTable* refTable[IPSEC_SA_REF_MAINTABLE_NUM_ENTRIES];
IPsecSAref_t refFreeList[IPSEC_SA_REF_FREELIST_NUM_ENTRIES];
int refFreeListHead;
int refFreeListTail;
IPsecSAref_t refFreeListCont;
IPsecSAref_t said_hash[SADB_HASHMOD];
spinlock_t sadb_lock;
};
extern struct ipsec_sadb ipsec_sadb;
extern int ipsec_SAref_recycle(void);
extern int ipsec_SArefSubTable_alloc(unsigned table);
extern int ipsec_saref_freelist_init(void);
extern int ipsec_sadb_init(void);
extern struct ipsec_sa *ipsec_sa_alloc(int*error); /* pass in error var by pointer */
extern IPsecSAref_t ipsec_SAref_alloc(int*erorr); /* pass in error var by pointer */
extern int ipsec_sa_free(struct ipsec_sa* ips);
extern struct ipsec_sa *ipsec_sa_getbyid(struct sa_id *said);
extern int ipsec_sa_put(struct ipsec_sa *ips);
extern int ipsec_sa_add(struct ipsec_sa *ips);
extern int ipsec_sa_del(struct ipsec_sa *ips);
extern int ipsec_sa_delchain(struct ipsec_sa *ips);
extern int ipsec_sadb_cleanup(__u8 proto);
extern int ipsec_sadb_free(void);
extern int ipsec_sa_wipe(struct ipsec_sa *ips);
#endif /* __KERNEL__ */
enum ipsec_direction {
ipsec_incoming = 1,
ipsec_outgoing = 2
};
#define _IPSEC_SA_H_
#endif /* _IPSEC_SA_H_ */
/*
* $Log: ipsec_sa.h,v $
* Revision 1.3 2004/04/28 08:07:11 as
* added dhr's freeswan-2.06 changes
*
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.2.1.2.1 2004/03/16 09:48:18 as
* alg-0.8.1rc12 patch merged
*
* Revision 1.1.2.1 2004/03/15 22:30:06 as
* nat-0.6c patch merged
*
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.15 2003/05/11 00:53:09 mcr
* IPsecSAref_t and macros were moved to freeswan.h.
*
* Revision 1.14 2003/02/12 19:31:55 rgb
* Fixed bug in "file seen" machinery.
* Updated copyright year.
*
* Revision 1.13 2003/01/30 02:31:52 rgb
*
* Re-wrote comments describing SAref system for accuracy.
* Rename SAref table macro names for clarity.
* Convert IPsecSAref_t from signed to unsigned to fix apparent SAref exhaustion bug.
* Transmit error code through to caller from callee for better diagnosis of problems.
* Enclose all macro arguments in parens to avoid any possible obscrure bugs.
*
* Revision 1.12 2002/10/07 18:31:19 rgb
* Change comment to reflect the flexible nature of the main and sub-table widths.
* Added a counter for the number of unused entries in each subtable.
* Further break up host field type macro to host field.
* Move field width sanity checks to ipsec_sa.c
* Define a mask for an entire saref.
*
* Revision 1.11 2002/09/20 15:40:33 rgb
* Re-write most of the SAref macros and types to eliminate any pointer references to Entrys.
* Fixed SAref/nfmark macros.
* Rework saref freeslist.
* Place all ipsec sadb globals into one struct.
* Restrict some bits to kernel context for use to klips utils.
*
* Revision 1.10 2002/09/20 05:00:34 rgb
* Update copyright date.
*
* Revision 1.9 2002/09/17 17:19:29 mcr
* make it compile even if there is no netfilter - we lost
* functionality, but it works, especially on 2.2.
*
* Revision 1.8 2002/07/28 22:59:53 mcr
* clarified/expanded one comment.
*
* Revision 1.7 2002/07/26 08:48:31 rgb
* Added SA ref table code.
*
* Revision 1.6 2002/05/31 17:27:48 rgb
* Comment fix.
*
* Revision 1.5 2002/05/27 18:55:03 rgb
* Remove final vistiges of tdb references via IPSEC_KLIPS1_COMPAT.
*
* Revision 1.4 2002/05/23 07:13:36 rgb
* Convert "usecount" to "refcount" to remove ambiguity.
*
* Revision 1.3 2002/04/24 07:36:47 mcr
* Moved from ./klips/net/ipsec/ipsec_sa.h,v
*
* Revision 1.2 2001/11/26 09:16:15 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.1.2.1 2001/09/25 02:24:58 mcr
* struct tdb -> struct ipsec_sa.
* sa(tdb) manipulation functions renamed and moved to ipsec_sa.c
* ipsec_xform.c removed. header file still contains useful things.
*
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/
linux/include/freeswan/ipsec_sha1.h
+79
View File
@@ -0,0 +1,79 @@
/*
* RCSID $Id: ipsec_sha1.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
/*
* Here is the original comment from the distribution:
SHA-1 in C
By Steve Reid <[email protected]>
100% Public Domain
* Adapted for use by the IPSEC code by John Ioannidis
*/
#ifndef _IPSEC_SHA1_H_
#define _IPSEC_SHA1_H_
typedef struct
{
__u32 state[5];
__u32 count[2];
__u8 buffer[64];
} SHA1_CTX;
void SHA1Transform(__u32 state[5], __u8 buffer[64]);
void SHA1Init(void *context);
void SHA1Update(void *context, unsigned char *data, __u32 len);
void SHA1Final(unsigned char digest[20], void *context);
#endif /* _IPSEC_SHA1_H_ */
/*
* $Log: ipsec_sha1.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.7 2002/09/10 01:45:09 mcr
* changed type of MD5_CTX and SHA1_CTX to void * so that
* the function prototypes would match, and could be placed
* into a pointer to a function.
*
* Revision 1.6 2002/04/24 07:36:47 mcr
* Moved from ./klips/net/ipsec/ipsec_sha1.h,v
*
* Revision 1.5 1999/12/13 13:59:13 rgb
* Quick fix to argument size to Update bugs.
*
* Revision 1.4 1999/12/07 18:16:23 rgb
* Fixed comments at end of #endif lines.
*
* Revision 1.3 1999/04/06 04:54:27 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.2 1998/11/30 13:22:54 rgb
* Rationalised all the klips kernel file headers. They are much shorter
* now and won't conflict under RH5.2.
*
* Revision 1.1 1998/06/18 21:27:50 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.2 1998/04/23 20:54:05 rgb
* Fixed md5 and sha1 include file nesting issues, to be cleaned up when
* verified.
*
* Revision 1.1 1998/04/09 03:04:21 henry
* sources moved up from linux/net/ipsec
* these two include files modified not to include others except in kernel
*
* Revision 1.1.1.1 1998/04/08 05:35:04 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* New transform
*
*/
linux/include/freeswan/ipsec_stats.h
+38
View File
@@ -0,0 +1,38 @@
/*
* @(#) definition of ipsec_stats structure
*
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_stats.h,v 1.2 2004/03/30 19:33:52 as Exp $
*
*/
/*
* This file describes the errors/statistics that FreeSWAN collects.
*/
#ifndef _IPSEC_STATS_H_
struct ipsec_stats {
__u32 ips_alg_errs; /* number of algorithm errors */
__u32 ips_auth_errs; /* # of authentication errors */
__u32 ips_encsize_errs; /* # of encryption size errors*/
__u32 ips_encpad_errs; /* # of encryption pad errors*/
__u32 ips_replaywin_errs; /* # of pkt sequence errors */
};
extern int ipsec_snprintf(char * buf, ssize_t size, const char *fmt, ...);
#define _IPSEC_STATS_H_
#endif /* _IPSEC_STATS_H_ */
linux/include/freeswan/ipsec_tunnel.h
+265
View File
@@ -0,0 +1,265 @@
/*
* IPSEC tunneling code
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_tunnel.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#ifdef NET_21
# define DEV_QUEUE_XMIT(skb, device, pri) {\
skb->dev = device; \
neigh_compat_output(skb); \
/* skb->dst->output(skb); */ \
}
# define ICMP_SEND(skb_in, type, code, info, dev) \
icmp_send(skb_in, type, code, htonl(info))
# define IP_SEND(skb, dev) \
ip_send(skb);
#else /* NET_21 */
# define DEV_QUEUE_XMIT(skb, device, pri) {\
dev_queue_xmit(skb, device, pri); \
}
# define ICMP_SEND(skb_in, type, code, info, dev) \
icmp_send(skb_in, type, code, info, dev)
# define IP_SEND(skb, dev) \
if(ntohs(iph->tot_len) > physmtu) { \
ip_fragment(NULL, skb, dev, 0); \
ipsec_kfree_skb(skb); \
} else { \
dev_queue_xmit(skb, dev, SOPRI_NORMAL); \
}
#endif /* NET_21 */
/*
* Heavily based on drivers/net/new_tunnel.c. Lots
* of ideas also taken from the 2.1.x version of drivers/net/shaper.c
*/
struct ipsectunnelconf
{
__u32 cf_cmd;
union
{
char cfu_name[12];
} cf_u;
#define cf_name cf_u.cfu_name
};
#define IPSEC_SET_DEV (SIOCDEVPRIVATE)
#define IPSEC_DEL_DEV (SIOCDEVPRIVATE + 1)
#define IPSEC_CLR_DEV (SIOCDEVPRIVATE + 2)
#ifdef __KERNEL__
#include <linux/version.h>
#ifndef KERNEL_VERSION
# define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
#endif
struct ipsecpriv
{
struct sk_buff_head sendq;
struct device *dev;
struct wait_queue *wait_queue;
char locked;
int (*hard_start_xmit) (struct sk_buff *skb,
struct device *dev);
int (*hard_header) (struct sk_buff *skb,
struct device *dev,
unsigned short type,
void *daddr,
void *saddr,
unsigned len);
#ifdef NET_21
int (*rebuild_header)(struct sk_buff *skb);
#else /* NET_21 */
int (*rebuild_header)(void *buff, struct device *dev,
unsigned long raddr, struct sk_buff *skb);
#endif /* NET_21 */
int (*set_mac_address)(struct device *dev, void *addr);
#ifndef NET_21
void (*header_cache_bind)(struct hh_cache **hhp, struct device *dev,
unsigned short htype, __u32 daddr);
#endif /* !NET_21 */
void (*header_cache_update)(struct hh_cache *hh, struct device *dev, unsigned char * haddr);
struct net_device_stats *(*get_stats)(struct device *dev);
struct net_device_stats mystats;
int mtu; /* What is the desired MTU? */
};
extern char ipsec_tunnel_c_version[];
extern struct device *ipsecdevices[IPSEC_NUM_IF];
int ipsec_tunnel_init_devices(void);
/* void */ int ipsec_tunnel_cleanup_devices(void);
extern /* void */ int ipsec_init(void);
extern int ipsec_tunnel_start_xmit(struct sk_buff *skb, struct device *dev);
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_tunnel;
extern int sysctl_ipsec_debug_verbose;
#endif /* CONFIG_IPSEC_DEBUG */
#endif /* __KERNEL__ */
#ifdef CONFIG_IPSEC_DEBUG
#define DB_TN_INIT 0x0001
#define DB_TN_PROCFS 0x0002
#define DB_TN_XMIT 0x0010
#define DB_TN_OHDR 0x0020
#define DB_TN_CROUT 0x0040
#define DB_TN_OXFS 0x0080
#define DB_TN_REVEC 0x0100
#endif /* CONFIG_IPSEC_DEBUG */
/*
* $Log: ipsec_tunnel.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.28 2003/06/24 20:22:32 mcr
* added new global: ipsecdevices[] so that we can keep track of
* the ipsecX devices. They will be referenced with dev_hold(),
* so 2.2 may need this as well.
*
* Revision 1.27 2003/04/03 17:38:09 rgb
* Centralised ipsec_kfree_skb and ipsec_dev_{get,put}.
*
* Revision 1.26 2003/02/12 19:32:20 rgb
* Updated copyright year.
*
* Revision 1.25 2002/05/27 18:56:07 rgb
* Convert to dynamic ipsec device allocation.
*
* Revision 1.24 2002/04/24 07:36:48 mcr
* Moved from ./klips/net/ipsec/ipsec_tunnel.h,v
*
* Revision 1.23 2001/11/06 19:50:44 rgb
* Moved IP_SEND, ICMP_SEND, DEV_QUEUE_XMIT macros to ipsec_tunnel.h for
* use also by pfkey_v2_parser.c
*
* Revision 1.22 2001/09/15 16:24:05 rgb
* Re-inject first and last HOLD packet when an eroute REPLACE is done.
*
* Revision 1.21 2001/06/14 19:35:10 rgb
* Update copyright date.
*
* Revision 1.20 2000/09/15 11:37:02 rgb
* Merge in heavily modified Svenning Soerensen's <[email protected]>
* IPCOMP zlib deflate code.
*
* Revision 1.19 2000/09/08 19:12:56 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.18 2000/07/28 13:50:54 rgb
* Changed enet_statistics to net_device_stats and added back compatibility
* for pre-2.1.19.
*
* Revision 1.17 1999/11/19 01:12:15 rgb
* Purge unneeded proc_info prototypes, now that static linking uses
* dynamic proc_info registration.
*
* Revision 1.16 1999/11/18 18:51:00 rgb
* Changed all device registrations for static linking to
* dynamic to reduce the number and size of patches.
*
* Revision 1.15 1999/11/18 04:14:21 rgb
* Replaced all kernel version macros to shorter, readable form.
* Added CONFIG_PROC_FS compiler directives in case it is shut off.
* Added Marc Boucher's 2.3.25 proc patches.
*
* Revision 1.14 1999/05/25 02:50:10 rgb
* Fix kernel version macros for 2.0.x static linking.
*
* Revision 1.13 1999/05/25 02:41:06 rgb
* Add ipsec_klipsdebug support for static linking.
*
* Revision 1.12 1999/05/05 22:02:32 rgb
* Add a quick and dirty port to 2.2 kernels by Marc Boucher <[email protected]>.
*
* Revision 1.11 1999/04/29 15:19:50 rgb
* Add return values to init and cleanup functions.
*
* Revision 1.10 1999/04/16 16:02:39 rgb
* Bump up macro to 4 ipsec I/Fs.
*
* Revision 1.9 1999/04/15 15:37:25 rgb
* Forward check changes from POST1_00 branch.
*
* Revision 1.5.2.1 1999/04/02 04:26:14 rgb
* Backcheck from HEAD, pre1.0.
*
* Revision 1.8 1999/04/11 00:29:01 henry
* GPL boilerplate
*
* Revision 1.7 1999/04/06 04:54:28 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.6 1999/03/31 05:44:48 rgb
* Keep PMTU reduction private.
*
* Revision 1.5 1999/02/10 22:31:20 rgb
* Change rebuild_header member to reflect generality of link layer.
*
* Revision 1.4 1998/12/01 13:22:04 rgb
* Added support for debug printing of version info.
*
* Revision 1.3 1998/07/29 20:42:46 rgb
* Add a macro for clearing all tunnel devices.
* Rearrange structures and declarations for sharing with userspace.
*
* Revision 1.2 1998/06/25 20:01:45 rgb
* Make prototypes available for ipsec_init and ipsec proc_dir_entries
* for static linking.
*
* Revision 1.1 1998/06/18 21:27:50 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.3 1998/05/18 21:51:50 rgb
* Added macros for num of I/F's and a procfs debug switch.
*
* Revision 1.2 1998/04/21 21:29:09 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.1 1998/04/09 03:06:13 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:05 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.5 1997/06/03 04:24:48 ji
* Added transport mode.
* Changed the way routing is done.
* Lots of bug fixes.
*
* Revision 0.4 1997/01/15 01:28:15 ji
* No changes.
*
* Revision 0.3 1996/11/20 14:39:04 ji
* Minor cleanups.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_xform.h
+274
View File
@@ -0,0 +1,274 @@
/*
* Definitions relevant to IPSEC transformations
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_xform.h,v 1.3 2004/09/29 22:26:13 as Exp $
*/
#ifndef _IPSEC_XFORM_H_
#include <freeswan.h>
#include "ipsec_policy.h"
#define XF_NONE 0 /* No transform set */
#define XF_IP4 1 /* IPv4 inside IPv4 */
#define XF_AHMD5 2 /* AH MD5 */
#define XF_AHSHA 3 /* AH SHA */
#define XF_ESP3DES 5 /* ESP DES3-CBC */
#define XF_AHHMACMD5 6 /* AH-HMAC-MD5 with opt replay prot */
#define XF_AHHMACSHA1 7 /* AH-HMAC-SHA1 with opt replay prot */
#define XF_ESP3DESMD5 9 /* triple DES, HMAC-MD-5, 128-bits of authentication */
#define XF_ESP3DESMD596 10 /* triple DES, HMAC-MD-5, 96-bits of authentication */
#define XF_ESPNULLMD596 12 /* NULL, HMAC-MD-5 with 96-bits of authentication */
#define XF_ESPNULLSHA196 13 /* NULL, HMAC-SHA-1 with 96-bits of authentication */
#define XF_ESP3DESSHA196 14 /* triple DES, HMAC-SHA-1, 96-bits of authentication */
#define XF_IP6 15 /* IPv6 inside IPv6 */
#define XF_COMPDEFLATE 16 /* IPCOMP deflate */
#define XF_CLR 126 /* Clear SA table */
#define XF_DEL 127 /* Delete SA */
#define XFT_AUTH 0x0001
#define XFT_CONF 0x0100
/* available if CONFIG_IPSEC_DEBUG is defined */
#define DB_XF_INIT 0x0001
#define PROTO2TXT(x) \
(x) == IPPROTO_AH ? "AH" : \
(x) == IPPROTO_ESP ? "ESP" : \
(x) == IPPROTO_IPIP ? "IPIP" : \
(x) == IPPROTO_COMP ? "COMP" : \
"UNKNOWN_proto"
static inline const char *enc_name_id (unsigned id) {
static char buf[16];
snprintf(buf, sizeof(buf), "_ID%d", id);
return buf;
}
static inline const char *auth_name_id (unsigned id) {
static char buf[16];
snprintf(buf, sizeof(buf), "_ID%d", id);
return buf;
}
#define IPS_XFORM_NAME(x) \
PROTO2TXT((x)->ips_said.proto), \
(x)->ips_said.proto == IPPROTO_COMP ? \
((x)->ips_encalg == SADB_X_CALG_DEFLATE ? \
"_DEFLATE" : "_UNKNOWN_comp") : \
(x)->ips_encalg == ESP_NONE ? "" : \
(x)->ips_encalg == ESP_3DES ? "_3DES" : \
(x)->ips_encalg == ESP_AES ? "_AES" : \
(x)->ips_encalg == ESP_SERPENT ? "_SERPENT" : \
(x)->ips_encalg == ESP_TWOFISH ? "_TWOFISH" : \
enc_name_id(x->ips_encalg)/* "_UNKNOWN_encr" */, \
(x)->ips_authalg == AH_NONE ? "" : \
(x)->ips_authalg == AH_MD5 ? "_HMAC_MD5" : \
(x)->ips_authalg == AH_SHA ? "_HMAC_SHA1" : \
(x)->ips_authalg == AH_SHA2_256 ? "_HMAC_SHA2_256" : \
(x)->ips_authalg == AH_SHA2_384 ? "_HMAC_SHA2_384" : \
(x)->ips_authalg == AH_SHA2_512 ? "_HMAC_SHA2_512" : \
auth_name_id(x->ips_authalg) /* "_UNKNOWN_auth" */ \
#define _IPSEC_XFORM_H_
#endif /* _IPSEC_XFORM_H_ */
/*
* $Log: ipsec_xform.h,v $
* Revision 1.3 2004/09/29 22:26:13 as
* included ipsec_policy.h
*
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.4.1 2004/03/16 09:48:18 as
* alg-0.8.1rc12 patch merged
*
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.36 2002/04/24 07:36:48 mcr
* Moved from ./klips/net/ipsec/ipsec_xform.h,v
*
* Revision 1.35 2001/11/26 09:23:51 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.33.2.1 2001/09/25 02:24:58 mcr
* struct tdb -> struct ipsec_sa.
* sa(tdb) manipulation functions renamed and moved to ipsec_sa.c
* ipsec_xform.c removed. header file still contains useful things.
*
* Revision 1.34 2001/11/06 19:47:17 rgb
* Changed lifetime_packets to uint32 from uint64.
*
* Revision 1.33 2001/09/08 21:13:34 rgb
* Added pfkey ident extension support for ISAKMPd. (NetCelo)
*
* Revision 1.32 2001/07/06 07:40:01 rgb
* Reformatted for readability.
* Added inbound policy checking fields for use with IPIP SAs.
*
* Revision 1.31 2001/06/14 19:35:11 rgb
* Update copyright date.
*
* Revision 1.30 2001/05/30 08:14:03 rgb
* Removed vestiges of esp-null transforms.
*
* Revision 1.29 2001/01/30 23:42:47 rgb
* Allow pfkey msgs from pid other than user context required for ACQUIRE
* and subsequent ADD or UDATE.
*
* Revision 1.28 2000/11/06 04:30:40 rgb
* Add Svenning's adaptive content compression.
*
* Revision 1.27 2000/09/19 00:38:25 rgb
* Fixed algorithm name bugs introduced for ipcomp.
*
* Revision 1.26 2000/09/17 21:36:48 rgb
* Added proto2txt macro.
*
* Revision 1.25 2000/09/17 18:56:47 rgb
* Added IPCOMP support.
*
* Revision 1.24 2000/09/12 19:34:12 rgb
* Defined XF_IP6 from Gerhard for ipv6 tunnel support.
*
* Revision 1.23 2000/09/12 03:23:14 rgb
* Cleaned out now unused tdb_xform and tdb_xdata members of struct tdb.
*
* Revision 1.22 2000/09/08 19:12:56 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.21 2000/09/01 18:32:43 rgb
* Added (disabled) sensitivity members to tdb struct.
*
* Revision 1.20 2000/08/30 05:31:01 rgb
* Removed all the rest of the references to tdb_spi, tdb_proto, tdb_dst.
* Kill remainder of tdb_xform, tdb_xdata, xformsw.
*
* Revision 1.19 2000/08/01 14:51:52 rgb
* Removed _all_ remaining traces of DES.
*
* Revision 1.18 2000/01/21 06:17:45 rgb
* Tidied up spacing.
*
* Revision 1.17 1999/11/17 15:53:40 rgb
* Changed all occurrences of #include "../../../lib/freeswan.h"
* to #include <freeswan.h> which works due to -Ilibfreeswan in the
* klips/net/ipsec/Makefile.
*
* Revision 1.16 1999/10/16 04:23:07 rgb
* Add stats for replaywin_errs, replaywin_max_sequence_difference,
* authentication errors, encryption size errors, encryption padding
* errors, and time since last packet.
*
* Revision 1.15 1999/10/16 00:29:11 rgb
* Added SA lifetime packet counting variables.
*
* Revision 1.14 1999/10/01 00:04:14 rgb
* Added tdb structure locking.
* Add function to initialize tdb hash table.
*
* Revision 1.13 1999/04/29 15:20:57 rgb
* dd return values to init and cleanup functions.
* Eliminate unnessessary usage of tdb_xform member to further switch
* away from the transform switch to the algorithm switch.
* Change gettdb parameter to a pointer to reduce stack loading and
* facilitate parameter sanity checking.
* Add a parameter to tdbcleanup to be able to delete a class of SAs.
*
* Revision 1.12 1999/04/15 15:37:25 rgb
* Forward check changes from POST1_00 branch.
*
* Revision 1.9.2.2 1999/04/13 20:35:57 rgb
* Fix spelling mistake in comment.
*
* Revision 1.9.2.1 1999/03/30 17:13:52 rgb
* Extend struct tdb to support pfkey.
*
* Revision 1.11 1999/04/11 00:29:01 henry
* GPL boilerplate
*
* Revision 1.10 1999/04/06 04:54:28 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.9 1999/01/26 02:09:31 rgb
* Removed CONFIG_IPSEC_ALGO_SWITCH macro.
* Removed dead code.
*
* Revision 1.8 1999/01/22 06:29:35 rgb
* Added algorithm switch code.
* Cruft clean-out.
*
* Revision 1.7 1998/11/10 05:37:35 rgb
* Add support for SA direction flag.
*
* Revision 1.6 1998/10/19 14:44:29 rgb
* Added inclusion of freeswan.h.
* sa_id structure implemented and used: now includes protocol.
*
* Revision 1.5 1998/08/12 00:12:30 rgb
* Added macros for new xforms. Added prototypes for new xforms.
*
* Revision 1.4 1998/07/28 00:04:20 rgb
* Add macro for clearing the SA table.
*
* Revision 1.3 1998/07/14 18:06:46 rgb
* Added #ifdef __KERNEL__ directives to restrict scope of header.
*
* Revision 1.2 1998/06/23 03:02:19 rgb
* Created a prototype for ipsec_tdbcleanup when it was moved from
* ipsec_init.c.
*
* Revision 1.1 1998/06/18 21:27:51 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.4 1998/06/11 05:55:31 rgb
* Added transform version string pointer to xformsw structure definition.
* Added extern declarations for transform version strings.
*
* Revision 1.3 1998/05/18 22:02:54 rgb
* Modify the *_zeroize function prototypes to include one parameter.
*
* Revision 1.2 1998/04/21 21:29:08 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.1 1998/04/09 03:06:14 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:06 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.5 1997/06/03 04:24:48 ji
* Added ESP-3DES-MD5-96
*
* Revision 0.4 1997/01/15 01:28:15 ji
* Added new transforms.
*
* Revision 0.3 1996/11/20 14:39:04 ji
* Minor cleanups.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/
linux/include/freeswan/ipsec_xmit.h
+140
View File
@@ -0,0 +1,140 @@
/*
* IPSEC tunneling code
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_xmit.h,v 1.3 2004/06/13 19:37:07 as Exp $
*/
#include "freeswan/ipsec_sa.h"
enum ipsec_xmit_value
{
IPSEC_XMIT_STOLEN=2,
IPSEC_XMIT_PASS=1,
IPSEC_XMIT_OK=0,
IPSEC_XMIT_ERRMEMALLOC=-1,
IPSEC_XMIT_ESP_BADALG=-2,
IPSEC_XMIT_BADPROTO=-3,
IPSEC_XMIT_ESP_PUSHPULLERR=-4,
IPSEC_XMIT_BADLEN=-5,
IPSEC_XMIT_AH_BADALG=-6,
IPSEC_XMIT_SAIDNOTFOUND=-7,
IPSEC_XMIT_SAIDNOTLIVE=-8,
IPSEC_XMIT_REPLAYROLLED=-9,
IPSEC_XMIT_LIFETIMEFAILED=-10,
IPSEC_XMIT_CANNOTFRAG=-11,
IPSEC_XMIT_MSSERR=-12,
IPSEC_XMIT_ERRSKBALLOC=-13,
IPSEC_XMIT_ENCAPFAIL=-14,
IPSEC_XMIT_NODEV=-15,
IPSEC_XMIT_NOPRIVDEV=-16,
IPSEC_XMIT_NOPHYSDEV=-17,
IPSEC_XMIT_NOSKB=-18,
IPSEC_XMIT_NOIPV6=-19,
IPSEC_XMIT_NOIPOPTIONS=-20,
IPSEC_XMIT_TTLEXPIRED=-21,
IPSEC_XMIT_BADHHLEN=-22,
IPSEC_XMIT_PUSHPULLERR=-23,
IPSEC_XMIT_ROUTEERR=-24,
IPSEC_XMIT_RECURSDETECT=-25,
IPSEC_XMIT_IPSENDFAILURE=-26,
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
IPSEC_XMIT_ESPUDP=-27,
#endif
};
struct ipsec_xmit_state
{
struct sk_buff *skb; /* working skb pointer */
struct device *dev; /* working dev pointer */
struct ipsecpriv *prv; /* Our device' private space */
struct sk_buff *oskb; /* Original skb pointer */
struct net_device_stats *stats; /* This device's statistics */
struct iphdr *iph; /* Our new IP header */
__u32 newdst; /* The other SG's IP address */
__u32 orgdst; /* Original IP destination address */
__u32 orgedst; /* 1st SG's IP address */
__u32 newsrc; /* The new source SG's IP address */
__u32 orgsrc; /* Original IP source address */
__u32 innersrc; /* Innermost IP source address */
int iphlen; /* IP header length */
int pyldsz; /* upper protocol payload size */
int headroom;
int tailroom;
int max_headroom; /* The extra header space needed */
int max_tailroom; /* The extra stuffing needed */
int ll_headroom; /* The extra link layer hard_header space needed */
int tot_headroom; /* The total header space needed */
int tot_tailroom; /* The totalstuffing needed */
__u8 *saved_header; /* saved copy of the hard header */
unsigned short sport, dport;
struct sockaddr_encap matcher; /* eroute search key */
struct eroute *eroute;
struct ipsec_sa *ipsp, *ipsq; /* ipsec_sa pointers */
char sa_txt[SATOA_BUF];
size_t sa_len;
int hard_header_stripped; /* has the hard header been removed yet? */
int hard_header_len;
struct device *physdev;
/* struct device *virtdev; */
short physmtu;
short mtudiff;
#ifdef NET_21
struct rtable *route;
#endif /* NET_21 */
struct sa_id outgoing_said;
#ifdef NET_21
int pass;
#endif /* NET_21 */
int error;
uint32_t eroute_pid;
struct ipsec_sa ips;
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
uint8_t natt_type;
uint8_t natt_head;
uint16_t natt_sport;
uint16_t natt_dport;
#endif
};
#if 0 /* save for alg refactorisation */
struct xform_functions
{
enum ipsec_xmit_value (*checks)(struct ipsec_xmit_state *ixs,
struct sk_buff *skb);
enum ipsec_xmit_value (*encrypt)(struct ipsec_xmit_state *ixs);
enum ipsec_xmit_value (*setup_auth)(struct ipsec_xmit_state *ixs,
struct sk_buff *skb,
__u32 *replay,
unsigned char **authenticator);
enum ipsec_xmit_value (*calc_auth)(struct ipsec_xmit_state *ixs,
struct sk_buff *skb);
};
#endif
enum ipsec_xmit_value
ipsec_xmit_sanity_check_dev(struct ipsec_xmit_state *ixs);
enum ipsec_xmit_value
ipsec_xmit_sanity_check_skb(struct ipsec_xmit_state *ixs);
enum ipsec_xmit_value
ipsec_xmit_encap_bundle(struct ipsec_xmit_state *ixs);
extern int ipsec_xmit_trap_count;
extern int ipsec_xmit_trap_sendcount;
extern void ipsec_extract_ports(struct iphdr * iph, struct sockaddr_encap * er);
linux/include/freeswan/radij.h
+280
View File
@@ -0,0 +1,280 @@
/*
* RCSID $Id: radij.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
/*
* This file is defived from ${SRC}/sys/net/radix.h of BSD 4.4lite
*
* Variable and procedure names have been modified so that they don't
* conflict with the original BSD code, as a small number of modifications
* have been introduced and we may want to reuse this code in BSD.
*
* The `j' in `radij' is pronounced as a voiceless guttural (like a Greek
* chi or a German ch sound (as `doch', not as in `milch'), or even a
* spanish j as in Juan. It is not as far back in the throat like
* the corresponding Hebrew sound, nor is it a soft breath like the English h.
* It has nothing to do with the Dutch ij sound.
*
* Here is the appropriate copyright notice:
*/
/*
* Copyright (c) 1988, 1989, 1993
* The Regents of the University of California. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* This product includes software developed by the University of
* California, Berkeley and its contributors.
* 4. Neither the name of the University nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* @(#)radix.h 8.1 (Berkeley) 6/10/93
*/
#ifndef _RADIJ_H_
#define _RADIJ_H_
/*
#define RJ_DEBUG
*/
#ifdef __KERNEL__
#ifndef __P
#ifdef __STDC__
#define __P(x) x
#else
#define __P(x) ()
#endif
#endif
/*
* Radix search tree node layout.
*/
struct radij_node
{
struct radij_mask *rj_mklist; /* list of masks contained in subtree */
struct radij_node *rj_p; /* parent */
short rj_b; /* bit offset; -1-index(netmask) */
char rj_bmask; /* node: mask for bit test*/
u_char rj_flags; /* enumerated next */
#define RJF_NORMAL 1 /* leaf contains normal route */
#define RJF_ROOT 2 /* leaf is root leaf for tree */
#define RJF_ACTIVE 4 /* This node is alive (for rtfree) */
union {
struct { /* leaf only data: */
caddr_t rj_Key; /* object of search */
caddr_t rj_Mask; /* netmask, if present */
struct radij_node *rj_Dupedkey;
} rj_leaf;
struct { /* node only data: */
int rj_Off; /* where to start compare */
struct radij_node *rj_L;/* progeny */
struct radij_node *rj_R;/* progeny */
}rj_node;
} rj_u;
#ifdef RJ_DEBUG
int rj_info;
struct radij_node *rj_twin;
struct radij_node *rj_ybro;
#endif
};
#define rj_dupedkey rj_u.rj_leaf.rj_Dupedkey
#define rj_key rj_u.rj_leaf.rj_Key
#define rj_mask rj_u.rj_leaf.rj_Mask
#define rj_off rj_u.rj_node.rj_Off
#define rj_l rj_u.rj_node.rj_L
#define rj_r rj_u.rj_node.rj_R
/*
* Annotations to tree concerning potential routes applying to subtrees.
*/
extern struct radij_mask {
short rm_b; /* bit offset; -1-index(netmask) */
char rm_unused; /* cf. rj_bmask */
u_char rm_flags; /* cf. rj_flags */
struct radij_mask *rm_mklist; /* more masks to try */
caddr_t rm_mask; /* the mask */
int rm_refs; /* # of references to this struct */
} *rj_mkfreelist;
#define MKGet(m) {\
if (rj_mkfreelist) {\
m = rj_mkfreelist; \
rj_mkfreelist = (m)->rm_mklist; \
} else \
R_Malloc(m, struct radij_mask *, sizeof (*(m))); }\
#define MKFree(m) { (m)->rm_mklist = rj_mkfreelist; rj_mkfreelist = (m);}
struct radij_node_head {
struct radij_node *rnh_treetop;
int rnh_addrsize; /* permit, but not require fixed keys */
int rnh_pktsize; /* permit, but not require fixed keys */
#if 0
struct radij_node *(*rnh_addaddr) /* add based on sockaddr */
__P((void *v, void *mask,
struct radij_node_head *head, struct radij_node nodes[]));
#endif
int (*rnh_addaddr) /* add based on sockaddr */
__P((void *v, void *mask,
struct radij_node_head *head, struct radij_node nodes[]));
struct radij_node *(*rnh_addpkt) /* add based on packet hdr */
__P((void *v, void *mask,
struct radij_node_head *head, struct radij_node nodes[]));
#if 0
struct radij_node *(*rnh_deladdr) /* remove based on sockaddr */
__P((void *v, void *mask, struct radij_node_head *head));
#endif
int (*rnh_deladdr) /* remove based on sockaddr */
__P((void *v, void *mask, struct radij_node_head *head, struct radij_node **node));
struct radij_node *(*rnh_delpkt) /* remove based on packet hdr */
__P((void *v, void *mask, struct radij_node_head *head));
struct radij_node *(*rnh_matchaddr) /* locate based on sockaddr */
__P((void *v, struct radij_node_head *head));
struct radij_node *(*rnh_matchpkt) /* locate based on packet hdr */
__P((void *v, struct radij_node_head *head));
int (*rnh_walktree) /* traverse tree */
__P((struct radij_node_head *head, int (*f)(struct radij_node *rn, void *w), void *w));
struct radij_node rnh_nodes[3]; /* empty tree for common case */
};
#define Bcmp(a, b, n) memcmp(((caddr_t)(b)), ((caddr_t)(a)), (unsigned)(n))
#define Bcopy(a, b, n) memmove(((caddr_t)(b)), ((caddr_t)(a)), (unsigned)(n))
#define Bzero(p, n) memset((caddr_t)(p), 0, (unsigned)(n))
#define R_Malloc(p, t, n) ((p = (t) kmalloc((size_t)(n), GFP_ATOMIC)), Bzero((p),(n)))
#define Free(p) kfree((caddr_t)p);
void rj_init __P((void));
int rj_inithead __P((void **, int));
int rj_refines __P((void *, void *));
int rj_walktree __P((struct radij_node_head *head, int (*f)(struct radij_node *rn, void *w), void *w));
struct radij_node
*rj_addmask __P((void *, int, int)) /* , rgb */ ;
int /* * */ rj_addroute __P((void *, void *, struct radij_node_head *,
struct radij_node [2])) /* , rgb */ ;
int /* * */ rj_delete __P((void *, void *, struct radij_node_head *, struct radij_node **)) /* , rgb */ ;
struct radij_node /* rgb */
*rj_insert __P((void *, struct radij_node_head *, int *,
struct radij_node [2])),
*rj_match __P((void *, struct radij_node_head *)),
*rj_newpair __P((void *, int, struct radij_node[2])),
*rj_search __P((void *, struct radij_node *)),
*rj_search_m __P((void *, struct radij_node *, void *));
void rj_deltree(struct radij_node_head *);
void rj_delnodes(struct radij_node *);
void rj_free_mkfreelist(void);
int radijcleartree(void);
int radijcleanup(void);
extern struct radij_node_head *mask_rjhead;
extern int maj_keylen;
#endif /* __KERNEL__ */
#endif /* _RADIJ_H_ */
/*
* $Log: radij.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.12 2002/04/24 07:36:48 mcr
* Moved from ./klips/net/ipsec/radij.h,v
*
* Revision 1.11 2001/09/20 15:33:00 rgb
* Min/max cleanup.
*
* Revision 1.10 1999/11/18 04:09:20 rgb
* Replaced all kernel version macros to shorter, readable form.
*
* Revision 1.9 1999/05/05 22:02:33 rgb
* Add a quick and dirty port to 2.2 kernels by Marc Boucher <[email protected]>.
*
* Revision 1.8 1999/04/29 15:24:58 rgb
* Add check for existence of macros min/max.
*
* Revision 1.7 1999/04/11 00:29:02 henry
* GPL boilerplate
*
* Revision 1.6 1999/04/06 04:54:29 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.5 1999/01/22 06:30:32 rgb
* 64-bit clean-up.
*
* Revision 1.4 1998/11/30 13:22:55 rgb
* Rationalised all the klips kernel file headers. They are much shorter
* now and won't conflict under RH5.2.
*
* Revision 1.3 1998/10/25 02:43:27 rgb
* Change return type on rj_addroute and rj_delete and add and argument
* to the latter to be able to transmit more infomation about errors.
*
* Revision 1.2 1998/07/14 18:09:51 rgb
* Add a routine to clear eroute table.
* Added #ifdef __KERNEL__ directives to restrict scope of header.
*
* Revision 1.1 1998/06/18 21:30:22 henry
* move sources from klips/src to klips/net/ipsec to keep stupid kernel
* build scripts happier about symlinks
*
* Revision 1.4 1998/05/25 20:34:16 rgb
* Remove temporary ipsec_walk, rj_deltree and rj_delnodes functions.
*
* Rename ipsec_rj_walker (ipsec_walk) to ipsec_rj_walker_procprint and
* add ipsec_rj_walker_delete.
*
* Recover memory for eroute table on unload of module.
*
* Revision 1.3 1998/04/22 16:51:37 rgb
* Tidy up radij debug code from recent rash of modifications to debug code.
*
* Revision 1.2 1998/04/14 17:30:38 rgb
* Fix up compiling errors for radij tree memory reclamation.
*
* Revision 1.1 1998/04/09 03:06:16 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:04 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* No changes.
*
* Revision 0.3 1996/11/20 14:44:45 ji
* Release update only.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/mast.h
+33
View File
@@ -0,0 +1,33 @@
struct mast_callbacks {
int (*packet_encap)(struct device *mast, void *context,
struct sk_buff *skb, int flowref);
int (*link_inquire)(struct device *mast, void *context);
};
struct device *mast_init (int family,
struct mast_callbacks *callbacks,
unsigned int flags,
unsigned int desired_unit,
unsigned int max_flowref,
void *context);
int mast_destroy(struct device *mast);
int mast_recv(struct device *mast, struct sk_buff *skb, int flowref);
/* free this skb as being useless, increment failure count. */
int mast_toast(struct device *mast, struct sk_buff *skb, int flowref);
int mast_linkstat (struct device *mast, int flowref,
int status);
int mast_setreference (struct device *mast,
int defaultSA);
int mast_setneighbor (struct device *mast,
struct sockaddr *source,
struct sockaddr *destination,
int flowref);
linux/include/pfkey.h
+498
View File
@@ -0,0 +1,498 @@
/*
* FreeS/WAN specific PF_KEY headers
* Copyright (C) 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: pfkey.h,v 1.2 2004/03/22 21:53:18 as Exp $
*/
#ifndef __NET_IPSEC_PF_KEY_H
#define __NET_IPSEC_PF_KEY_H
#ifdef __KERNEL__
extern struct proto_ops pfkey_proto_ops;
typedef struct sock pfkey_sock;
extern int debug_pfkey;
extern /* void */ int pfkey_init(void);
extern /* void */ int pfkey_cleanup(void);
extern struct sock *pfkey_sock_list;
struct socket_list
{
struct socket *socketp;
struct socket_list *next;
};
extern int pfkey_list_insert_socket(struct socket*, struct socket_list**);
extern int pfkey_list_remove_socket(struct socket*, struct socket_list**);
extern struct socket_list *pfkey_open_sockets;
extern struct socket_list *pfkey_registered_sockets[SADB_SATYPE_MAX+1];
/*
* There is a field-by-field copy in klips/net/ipsec/ipsec_alg.h
* please keep in sync until we migrate all support stuff
* to ipsec_alg objects
*/
struct supported
{
uint16_t supported_alg_exttype;
uint8_t supported_alg_id;
uint8_t supported_alg_ivlen;
uint16_t supported_alg_minbits;
uint16_t supported_alg_maxbits;
};
extern struct supported_list *pfkey_supported_list[SADB_SATYPE_MAX+1];
struct supported_list
{
struct supported *supportedp;
struct supported_list *next;
};
extern int pfkey_list_insert_supported(struct supported*, struct supported_list**);
extern int pfkey_list_remove_supported(struct supported*, struct supported_list**);
struct sockaddr_key
{
uint16_t key_family; /* PF_KEY */
uint16_t key_pad; /* not used */
uint32_t key_pid; /* process ID */
};
struct pfkey_extracted_data
{
struct ipsec_sa* ips;
struct ipsec_sa* ips2;
struct eroute *eroute;
};
extern int
pfkey_alloc_eroute(struct eroute** eroute);
extern int
pfkey_sa_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_lifetime_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_address_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_key_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_ident_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_sens_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_prop_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_supported_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_spirange_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_x_kmprivate_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_x_satype_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_x_debug_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int pfkey_register_reply(int satype, struct sadb_msg *);
extern int pfkey_upmsg(struct socket *, struct sadb_msg *);
extern int pfkey_expire(struct ipsec_sa *, int);
extern int pfkey_acquire(struct ipsec_sa *);
#else /* ! __KERNEL__ */
extern void (*pfkey_debug_func)(const char *message, ...);
#endif /* __KERNEL__ */
extern uint8_t satype2proto(uint8_t satype);
extern uint8_t proto2satype(uint8_t proto);
extern char* satype2name(uint8_t satype);
extern char* proto2name(uint8_t proto);
struct key_opt
{
uint32_t key_pid; /* process ID */
struct sock *sk;
};
#define key_pid(sk) ((struct key_opt*)&((sk)->protinfo))->key_pid
#define IPSEC_PFKEYv2_ALIGN (sizeof(uint64_t)/sizeof(uint8_t))
#define BITS_PER_OCTET 8
#define OCTETBITS 8
#define PFKEYBITS 64
#define DIVUP(x,y) ((x + y -1) / y) /* divide, rounding upwards */
#define ALIGN_N(x,y) (DIVUP(x,y) * y) /* align on y boundary */
#define PFKEYv2_MAX_MSGSIZE 4096
/*
* PF_KEYv2 permitted and required extensions in and out bitmaps
*/
struct pf_key_ext_parsers_def {
int (*parser)(struct sadb_ext*);
char *parser_name;
};
extern unsigned int extensions_bitmaps[2/*in/out*/][2/*perm/req*/][SADB_MAX + 1/*ext*/];
#define EXT_BITS_IN 0
#define EXT_BITS_OUT 1
#define EXT_BITS_PERM 0
#define EXT_BITS_REQ 1
extern void pfkey_extensions_init(struct sadb_ext *extensions[SADB_EXT_MAX + 1]);
extern void pfkey_extensions_free(struct sadb_ext *extensions[SADB_EXT_MAX + 1]);
extern void pfkey_msg_free(struct sadb_msg **pfkey_msg);
extern int pfkey_msg_parse(struct sadb_msg *pfkey_msg,
struct pf_key_ext_parsers_def *ext_parsers[],
struct sadb_ext **extensions,
int dir);
/*
* PF_KEYv2 build function prototypes
*/
int
pfkey_msg_hdr_build(struct sadb_ext** pfkey_ext,
uint8_t msg_type,
uint8_t satype,
uint8_t msg_errno,
uint32_t seq,
uint32_t pid);
int
pfkey_sa_ref_build(struct sadb_ext ** pfkey_ext,
uint16_t exttype,
uint32_t spi, /* in network order */
uint8_t replay_window,
uint8_t sa_state,
uint8_t auth,
uint8_t encrypt,
uint32_t flags,
uint32_t/*IPsecSAref_t*/ ref);
int
pfkey_sa_build(struct sadb_ext ** pfkey_ext,
uint16_t exttype,
uint32_t spi, /* in network order */
uint8_t replay_window,
uint8_t sa_state,
uint8_t auth,
uint8_t encrypt,
uint32_t flags);
int
pfkey_lifetime_build(struct sadb_ext ** pfkey_ext,
uint16_t exttype,
uint32_t allocations,
uint64_t bytes,
uint64_t addtime,
uint64_t usetime,
uint32_t packets);
int
pfkey_address_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
uint8_t proto,
uint8_t prefixlen,
struct sockaddr* address);
int
pfkey_key_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
uint16_t key_bits,
char* key);
int
pfkey_ident_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
uint16_t ident_type,
uint64_t ident_id,
uint8_t ident_len,
char* ident_string);
#ifdef NAT_TRAVERSAL
#ifdef __KERNEL__
extern int pfkey_nat_t_new_mapping(struct ipsec_sa *, struct sockaddr *, __u16);
extern int pfkey_x_nat_t_type_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr);
extern int pfkey_x_nat_t_port_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr);
#endif /* __KERNEL__ */
int
pfkey_x_nat_t_type_build(struct sadb_ext** pfkey_ext,
uint8_t type);
int
pfkey_x_nat_t_port_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
uint16_t port);
#endif
int
pfkey_sens_build(struct sadb_ext** pfkey_ext,
uint32_t dpd,
uint8_t sens_level,
uint8_t sens_len,
uint64_t* sens_bitmap,
uint8_t integ_level,
uint8_t integ_len,
uint64_t* integ_bitmap);
int pfkey_x_protocol_build(struct sadb_ext **, uint8_t);
int
pfkey_prop_build(struct sadb_ext** pfkey_ext,
uint8_t replay,
unsigned int comb_num,
struct sadb_comb* comb);
int
pfkey_supported_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
unsigned int alg_num,
struct sadb_alg* alg);
int
pfkey_spirange_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
uint32_t min,
uint32_t max);
int
pfkey_x_kmprivate_build(struct sadb_ext** pfkey_ext);
int
pfkey_x_satype_build(struct sadb_ext** pfkey_ext,
uint8_t satype);
int
pfkey_x_debug_build(struct sadb_ext** pfkey_ext,
uint32_t tunnel,
uint32_t netlink,
uint32_t xform,
uint32_t eroute,
uint32_t spi,
uint32_t radij,
uint32_t esp,
uint32_t ah,
uint32_t rcv,
uint32_t pfkey,
uint32_t ipcomp,
uint32_t verbose);
int
pfkey_msg_build(struct sadb_msg** pfkey_msg,
struct sadb_ext* extensions[],
int dir);
/* in pfkey_v2_debug.c - routines to decode numbers -> strings */
const char *
pfkey_v2_sadb_ext_string(int extnum);
const char *
pfkey_v2_sadb_type_string(int sadb_type);
#endif /* __NET_IPSEC_PF_KEY_H */
/*
* $Log: pfkey.h,v $
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.2.1.2.1 2004/03/16 09:48:18 as
* alg-0.8.1rc12 patch merged
*
* Revision 1.1.2.1 2004/03/15 22:30:06 as
* nat-0.6c patch merged
*
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.42 2003/08/25 22:08:19 mcr
* removed pfkey_proto_init() from pfkey.h for 2.6 support.
*
* Revision 1.41 2003/05/07 17:28:57 mcr
* new function pfkey_debug_func added for us in debugging from
* pfkey library.
*
* Revision 1.40 2003/01/30 02:31:34 rgb
*
* Convert IPsecSAref_t from signed to unsigned to fix apparent SAref exhaustion bug.
*
* Revision 1.39 2002/09/20 15:40:21 rgb
* Switch from pfkey_alloc_ipsec_sa() to ipsec_sa_alloc().
* Added ref parameter to pfkey_sa_build().
* Cleaned out unused cruft.
*
* Revision 1.38 2002/05/14 02:37:24 rgb
* Change all references to tdb, TDB or Tunnel Descriptor Block to ips,
* ipsec_sa or ipsec_sa.
* Added function prototypes for the functions moved to
* pfkey_v2_ext_process.c.
*
* Revision 1.37 2002/04/24 07:36:49 mcr
* Moved from ./lib/pfkey.h,v
*
* Revision 1.36 2002/01/20 20:34:49 mcr
* added pfkey_v2_sadb_type_string to decode sadb_type to string.
*
* Revision 1.35 2001/11/27 05:27:47 mcr
* pfkey parses are now maintained by a structure
* that includes their name for debug purposes.
*
* Revision 1.34 2001/11/26 09:23:53 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.33 2001/11/06 19:47:47 rgb
* Added packet parameter to lifetime and comb structures.
*
* Revision 1.32 2001/09/08 21:13:34 rgb
* Added pfkey ident extension support for ISAKMPd. (NetCelo)
*
* Revision 1.31 2001/06/14 19:35:16 rgb
* Update copyright date.
*
* Revision 1.30 2001/02/27 07:04:52 rgb
* Added satype2name prototype.
*
* Revision 1.29 2001/02/26 19:59:33 rgb
* Ditch unused sadb_satype2proto[], replaced by satype2proto().
*
* Revision 1.28 2000/10/10 20:10:19 rgb
* Added support for debug_ipcomp and debug_verbose to klipsdebug.
*
* Revision 1.27 2000/09/21 04:20:45 rgb
* Fixed array size off-by-one error. (Thanks Svenning!)
*
* Revision 1.26 2000/09/12 03:26:05 rgb
* Added pfkey_acquire prototype.
*
* Revision 1.25 2000/09/08 19:21:28 rgb
* Fix pfkey_prop_build() parameter to be only single indirection.
*
* Revision 1.24 2000/09/01 18:46:42 rgb
* Added a supported algorithms array lists, one per satype and registered
* existing algorithms.
* Fixed pfkey_list_{insert,remove}_{socket,support}() to allow change to
* list.
*
* Revision 1.23 2000/08/27 01:55:26 rgb
* Define OCTETBITS and PFKEYBITS to avoid using 'magic' numbers in code.
*
* Revision 1.22 2000/08/20 21:39:23 rgb
* Added kernel prototypes for kernel funcitions pfkey_upmsg() and
* pfkey_expire().
*
* Revision 1.21 2000/08/15 17:29:23 rgb
* Fixes from SZI to untested pfkey_prop_build().
*
* Revision 1.20 2000/05/10 20:14:19 rgb
* Fleshed out sensitivity, proposal and supported extensions.
*
* Revision 1.19 2000/03/16 14:07:23 rgb
* Renamed ALIGN macro to avoid fighting with others in kernel.
*
* Revision 1.18 2000/01/22 23:24:06 rgb
* Added prototypes for proto2satype(), satype2proto() and proto2name().
*
* Revision 1.17 2000/01/21 06:26:59 rgb
* Converted from double tdb arguments to one structure (extr)
* containing pointers to all temporary information structures.
* Added klipsdebug switching capability.
* Dropped unused argument to pfkey_x_satype_build().
*
* Revision 1.16 1999/12/29 21:17:41 rgb
* Changed pfkey_msg_build() I/F to include a struct sadb_msg**
* parameter for cleaner manipulation of extensions[] and to guard
* against potential memory leaks.
* Changed the I/F to pfkey_msg_free() for the same reason.
*
* Revision 1.15 1999/12/09 23:12:54 rgb
* Added macro for BITS_PER_OCTET.
* Added argument to pfkey_sa_build() to do eroutes.
*
* Revision 1.14 1999/12/08 20:33:25 rgb
* Changed sa_family_t to uint16_t for 2.0.xx compatibility.
*
* Revision 1.13 1999/12/07 19:53:40 rgb
* Removed unused first argument from extension parsers.
* Changed __u* types to uint* to avoid use of asm/types.h and
* sys/types.h in userspace code.
* Added function prototypes for pfkey message and extensions
* initialisation and cleanup.
*
* Revision 1.12 1999/12/01 22:19:38 rgb
* Change pfkey_sa_build to accept an SPI in network byte order.
*
* Revision 1.11 1999/11/27 11:55:26 rgb
* Added extern sadb_satype2proto to enable moving protocol lookup table
* to lib/pfkey_v2_parse.c.
* Delete unused, moved typedefs.
* Add argument to pfkey_msg_parse() for direction.
* Consolidated the 4 1-d extension bitmap arrays into one 4-d array.
*
* Revision 1.10 1999/11/23 22:29:21 rgb
* This file has been moved in the distribution from klips/net/ipsec to
* lib.
* Add macros for dealing with alignment and rounding up more opaquely.
* The uint<n>_t type defines have been moved to freeswan.h to avoid
* chicken-and-egg problems.
* Add macros for dealing with alignment and rounding up more opaque.
* Added prototypes for using extention header bitmaps.
* Added prototypes of all the build functions.
*
* Revision 1.9 1999/11/20 21:59:48 rgb
* Moved socketlist type declarations and prototypes for shared use.
* Slightly modified scope of sockaddr_key declaration.
*
* Revision 1.8 1999/11/17 14:34:25 rgb
* Protect sa_family_t from being used in userspace with GLIBC<2.
*
* Revision 1.7 1999/10/27 19:40:35 rgb
* Add a maximum PFKEY packet size macro.
*
* Revision 1.6 1999/10/26 16:58:58 rgb
* Created a sockaddr_key and key_opt socket extension structures.
*
* Revision 1.5 1999/06/10 05:24:41 rgb
* Renamed variables to reduce confusion.
*
* Revision 1.4 1999/04/29 15:21:11 rgb
* Add pfkey support to debugging.
* Add return values to init and cleanup functions.
*
* Revision 1.3 1999/04/15 17:58:07 rgb
* Add RCSID labels.
*
*/
linux/include/pfkeyv2.h
+385
View File
@@ -0,0 +1,385 @@
/*
* RCSID $Id: pfkeyv2.h,v 1.5 2004/10/04 22:43:56 as Exp $
*/
/*
RFC 2367 PF_KEY Key Management API July 1998
Appendix D: Sample Header File
This file defines structures and symbols for the PF_KEY Version 2
key management interface. It was written at the U.S. Naval Research
Laboratory. This file is in the public domain. The authors ask that
you leave this credit intact on any copies of this file.
*/
#ifndef __PFKEY_V2_H
#define __PFKEY_V2_H 1
#define PF_KEY_V2 2
#define PFKEYV2_REVISION 199806L
#define SADB_RESERVED 0
#define SADB_GETSPI 1
#define SADB_UPDATE 2
#define SADB_ADD 3
#define SADB_DELETE 4
#define SADB_GET 5
#define SADB_ACQUIRE 6
#define SADB_REGISTER 7
#define SADB_EXPIRE 8
#define SADB_FLUSH 9
#define SADB_DUMP 10
#define SADB_X_PROMISC 11
#define SADB_X_PCHANGE 12
#define SADB_X_GRPSA 13
#define SADB_X_ADDFLOW 14
#define SADB_X_DELFLOW 15
#define SADB_X_DEBUG 16
#ifdef NAT_TRAVERSAL
#define SADB_X_NAT_T_NEW_MAPPING 17
#define SADB_MAX 17
#else
#define SADB_MAX 16
#endif
struct sadb_msg {
uint8_t sadb_msg_version;
uint8_t sadb_msg_type;
uint8_t sadb_msg_errno;
uint8_t sadb_msg_satype;
uint16_t sadb_msg_len;
uint16_t sadb_msg_reserved;
uint32_t sadb_msg_seq;
uint32_t sadb_msg_pid;
};
struct sadb_ext {
uint16_t sadb_ext_len;
uint16_t sadb_ext_type;
};
struct sadb_sa {
uint16_t sadb_sa_len;
uint16_t sadb_sa_exttype;
uint32_t sadb_sa_spi;
uint8_t sadb_sa_replay;
uint8_t sadb_sa_state;
uint8_t sadb_sa_auth;
uint8_t sadb_sa_encrypt;
uint32_t sadb_sa_flags;
uint32_t /*IPsecSAref_t*/ sadb_x_sa_ref; /* 32 bits */
uint8_t sadb_x_reserved[4];
};
struct sadb_sa_v1 {
uint16_t sadb_sa_len;
uint16_t sadb_sa_exttype;
uint32_t sadb_sa_spi;
uint8_t sadb_sa_replay;
uint8_t sadb_sa_state;
uint8_t sadb_sa_auth;
uint8_t sadb_sa_encrypt;
uint32_t sadb_sa_flags;
};
struct sadb_lifetime {
uint16_t sadb_lifetime_len;
uint16_t sadb_lifetime_exttype;
uint32_t sadb_lifetime_allocations;
uint64_t sadb_lifetime_bytes;
uint64_t sadb_lifetime_addtime;
uint64_t sadb_lifetime_usetime;
uint32_t sadb_x_lifetime_packets;
uint32_t sadb_x_lifetime_reserved;
};
struct sadb_address {
uint16_t sadb_address_len;
uint16_t sadb_address_exttype;
uint8_t sadb_address_proto;
uint8_t sadb_address_prefixlen;
uint16_t sadb_address_reserved;
};
struct sadb_key {
uint16_t sadb_key_len;
uint16_t sadb_key_exttype;
uint16_t sadb_key_bits;
uint16_t sadb_key_reserved;
};
struct sadb_ident {
uint16_t sadb_ident_len;
uint16_t sadb_ident_exttype;
uint16_t sadb_ident_type;
uint16_t sadb_ident_reserved;
uint64_t sadb_ident_id;
};
struct sadb_sens {
uint16_t sadb_sens_len;
uint16_t sadb_sens_exttype;
uint32_t sadb_sens_dpd;
uint8_t sadb_sens_sens_level;
uint8_t sadb_sens_sens_len;
uint8_t sadb_sens_integ_level;
uint8_t sadb_sens_integ_len;
uint32_t sadb_sens_reserved;
};
struct sadb_prop {
uint16_t sadb_prop_len;
uint16_t sadb_prop_exttype;
uint8_t sadb_prop_replay;
uint8_t sadb_prop_reserved[3];
};
struct sadb_comb {
uint8_t sadb_comb_auth;
uint8_t sadb_comb_encrypt;
uint16_t sadb_comb_flags;
uint16_t sadb_comb_auth_minbits;
uint16_t sadb_comb_auth_maxbits;
uint16_t sadb_comb_encrypt_minbits;
uint16_t sadb_comb_encrypt_maxbits;
uint32_t sadb_comb_reserved;
uint32_t sadb_comb_soft_allocations;
uint32_t sadb_comb_hard_allocations;
uint64_t sadb_comb_soft_bytes;
uint64_t sadb_comb_hard_bytes;
uint64_t sadb_comb_soft_addtime;
uint64_t sadb_comb_hard_addtime;
uint64_t sadb_comb_soft_usetime;
uint64_t sadb_comb_hard_usetime;
uint32_t sadb_x_comb_soft_packets;
uint32_t sadb_x_comb_hard_packets;
};
struct sadb_supported {
uint16_t sadb_supported_len;
uint16_t sadb_supported_exttype;
uint32_t sadb_supported_reserved;
};
struct sadb_alg {
uint8_t sadb_alg_id;
uint8_t sadb_alg_ivlen;
uint16_t sadb_alg_minbits;
uint16_t sadb_alg_maxbits;
uint16_t sadb_alg_reserved;
};
struct sadb_spirange {
uint16_t sadb_spirange_len;
uint16_t sadb_spirange_exttype;
uint32_t sadb_spirange_min;
uint32_t sadb_spirange_max;
uint32_t sadb_spirange_reserved;
};
struct sadb_x_kmprivate {
uint16_t sadb_x_kmprivate_len;
uint16_t sadb_x_kmprivate_exttype;
uint32_t sadb_x_kmprivate_reserved;
};
struct sadb_x_satype {
uint16_t sadb_x_satype_len;
uint16_t sadb_x_satype_exttype;
uint8_t sadb_x_satype_satype;
uint8_t sadb_x_satype_reserved[3];
};
struct sadb_x_policy {
uint16_t sadb_x_policy_len;
uint16_t sadb_x_policy_exttype;
uint16_t sadb_x_policy_type;
uint8_t sadb_x_policy_dir;
uint8_t sadb_x_policy_reserved;
uint32_t sadb_x_policy_id;
uint32_t sadb_x_policy_reserved2;
};
struct sadb_x_debug {
uint16_t sadb_x_debug_len;
uint16_t sadb_x_debug_exttype;
uint32_t sadb_x_debug_tunnel;
uint32_t sadb_x_debug_netlink;
uint32_t sadb_x_debug_xform;
uint32_t sadb_x_debug_eroute;
uint32_t sadb_x_debug_spi;
uint32_t sadb_x_debug_radij;
uint32_t sadb_x_debug_esp;
uint32_t sadb_x_debug_ah;
uint32_t sadb_x_debug_rcv;
uint32_t sadb_x_debug_pfkey;
uint32_t sadb_x_debug_ipcomp;
uint32_t sadb_x_debug_verbose;
uint8_t sadb_x_debug_reserved[4];
};
#ifdef NAT_TRAVERSAL
struct sadb_x_nat_t_type {
uint16_t sadb_x_nat_t_type_len;
uint16_t sadb_x_nat_t_type_exttype;
uint8_t sadb_x_nat_t_type_type;
uint8_t sadb_x_nat_t_type_reserved[3];
};
struct sadb_x_nat_t_port {
uint16_t sadb_x_nat_t_port_len;
uint16_t sadb_x_nat_t_port_exttype;
uint16_t sadb_x_nat_t_port_port;
uint16_t sadb_x_nat_t_port_reserved;
};
#endif
/*
* A protocol structure for passing through the transport level
* protocol. It contains more fields than are actually used/needed
* but it is this way to be compatible with the structure used in
* OpenBSD (http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/pfkeyv2.h)
*/
struct sadb_protocol {
uint16_t sadb_protocol_len;
uint16_t sadb_protocol_exttype;
uint8_t sadb_protocol_proto;
uint8_t sadb_protocol_direction;
uint8_t sadb_protocol_flags;
uint8_t sadb_protocol_reserved2;
};
#define SADB_EXT_RESERVED 0
#define SADB_EXT_SA 1
#define SADB_EXT_LIFETIME_CURRENT 2
#define SADB_EXT_LIFETIME_HARD 3
#define SADB_EXT_LIFETIME_SOFT 4
#define SADB_EXT_ADDRESS_SRC 5
#define SADB_EXT_ADDRESS_DST 6
#define SADB_EXT_ADDRESS_PROXY 7
#define SADB_EXT_KEY_AUTH 8
#define SADB_EXT_KEY_ENCRYPT 9
#define SADB_EXT_IDENTITY_SRC 10
#define SADB_EXT_IDENTITY_DST 11
#define SADB_EXT_SENSITIVITY 12
#define SADB_EXT_PROPOSAL 13
#define SADB_EXT_SUPPORTED_AUTH 14
#define SADB_EXT_SUPPORTED_ENCRYPT 15
#define SADB_EXT_SPIRANGE 16
#define SADB_X_EXT_KMPRIVATE 17
#define SADB_X_EXT_SATYPE2 18
#ifdef KERNEL26_HAS_KAME_DUPLICATES
#define SADB_X_EXT_POLICY 18
#endif
#define SADB_X_EXT_SA2 19
#define SADB_X_EXT_ADDRESS_DST2 20
#define SADB_X_EXT_ADDRESS_SRC_FLOW 21
#define SADB_X_EXT_ADDRESS_DST_FLOW 22
#define SADB_X_EXT_ADDRESS_SRC_MASK 23
#define SADB_X_EXT_ADDRESS_DST_MASK 24
#define SADB_X_EXT_DEBUG 25
#define SADB_X_EXT_PROTOCOL 26
#ifdef NAT_TRAVERSAL
#define SADB_X_EXT_NAT_T_TYPE 27
#define SADB_X_EXT_NAT_T_SPORT 28
#define SADB_X_EXT_NAT_T_DPORT 29
#define SADB_X_EXT_NAT_T_OA 30
#define SADB_EXT_MAX 30
#else
#define SADB_EXT_MAX 26
#endif
/* SADB_X_DELFLOW required over and above SADB_X_SAFLAGS_CLEARFLOW */
#define SADB_X_EXT_ADDRESS_DELFLOW \
( (1<<SADB_X_EXT_ADDRESS_SRC_FLOW) \
| (1<<SADB_X_EXT_ADDRESS_DST_FLOW) \
| (1<<SADB_X_EXT_ADDRESS_SRC_MASK) \
| (1<<SADB_X_EXT_ADDRESS_DST_MASK))
#define SADB_SATYPE_UNSPEC 0
#define SADB_SATYPE_AH 2
#define SADB_SATYPE_ESP 3
#define SADB_SATYPE_RSVP 5
#define SADB_SATYPE_OSPFV2 6
#define SADB_SATYPE_RIPV2 7
#define SADB_SATYPE_MIP 8
#define SADB_X_SATYPE_IPIP 9
#ifdef KERNEL26_HAS_KAME_DUPLICATES
#define SADB_X_SATYPE_IPCOMP 9 /* ICK! */
#endif
#define SADB_X_SATYPE_COMP 10
#define SADB_X_SATYPE_INT 11
#define SADB_SATYPE_MAX 11
#define SADB_SASTATE_LARVAL 0
#define SADB_SASTATE_MATURE 1
#define SADB_SASTATE_DYING 2
#define SADB_SASTATE_DEAD 3
#define SADB_SASTATE_MAX 3
#define SADB_SAFLAGS_PFS 1
#define SADB_X_SAFLAGS_REPLACEFLOW 2
#define SADB_X_SAFLAGS_CLEARFLOW 4
#define SADB_X_SAFLAGS_INFLOW 8
/* not obvious, but these are the same values as used in isakmp,
* and in freeswan/ipsec_policy.h. If you need to add any, they
* should be added as according to
* http://www.iana.org/assignments/isakmp-registry
*
* and if not, then please try to use a private-use value, and
* consider asking IANA to assign a value.
*/
#define SADB_AALG_NONE 0
#define SADB_AALG_MD5_HMAC 2
#define SADB_AALG_SHA1_HMAC 3
#define SADB_AALG_DES_MAC 4
#define SADB_AALG_SHA2_256_HMAC 5
#define SADB_AALG_SHA2_384_HMAC 6
#define SADB_AALG_SHA2_512_HMAC 7
#define SADB_AALG_RIPEMD_160_HMAC 8
#define SADB_AALG_AES_XCBC_MAC 9
#define SADB_X_AALG_NULL 251 /* kame */
#define SADB_AALG_MAX 251
#define SADB_EALG_NONE 0
#define SADB_EALG_DES_CBC 2
#define SADB_EALG_3DES_CBC 3
#define SADB_EALG_RC5_CBC 4
#define SADB_EALG_IDEA_CBC 5
#define SADB_EALG_CAST_CBC 6
#define SADB_EALG_BLOWFISH_CBC 7
#define SADB_EALG_NULL 11
#define SADB_EALG_AES_CBC 12
#define SADB_EALG_AES_CTR 13
#define SADB_X_EALG_SERPENT_CBC 252
#define SADB_X_EALG_TWOFISH_CBC 253
#define SADB_EALG_MAX 253
#define SADB_X_CALG_NONE 0
#define SADB_X_CALG_OUI 1
#define SADB_X_CALG_DEFLATE 2
#define SADB_X_CALG_LZS 3
#define SADB_X_CALG_V42BIS 4
#ifdef KERNEL26_HAS_KAME_DUPLICATES
#define SADB_X_CALG_LZJH 4
#endif
#define SADB_X_CALG_MAX 4
#define SADB_X_TALG_NONE 0
#define SADB_X_TALG_IPv4_in_IPv4 1
#define SADB_X_TALG_IPv6_in_IPv4 2
#define SADB_X_TALG_IPv4_in_IPv6 3
#define SADB_X_TALG_IPv6_in_IPv6 4
#define SADB_X_TALG_MAX 4
#define SADB_IDENTTYPE_RESERVED 0
#define SADB_IDENTTYPE_PREFIX 1
#define SADB_IDENTTYPE_FQDN 2
#define SADB_IDENTTYPE_USERFQDN 3
#define SADB_X_IDENTTYPE_CONNECTION 4
#define SADB_IDENTTYPE_MAX 4
#define SADB_KEY_FLAGS_MAX 0
#endif /* __PFKEY_V2_H */
linux/include/zlib/zlib.h
+893
View File
@@ -0,0 +1,893 @@
/* zlib.h -- interface of the 'zlib' general purpose compression library
version 1.1.4, March 11th, 2002
Copyright (C) 1995-2002 Jean-loup Gailly and Mark Adler
This software is provided 'as-is', without any express or implied
warranty. In no event will the authors be held liable for any damages
arising from the use of this software.
Permission is granted to anyone to use this software for any purpose,
including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:
1. The origin of this software must not be misrepresented; you must not
claim that you wrote the original software. If you use this software
in a product, an acknowledgment in the product documentation would be
appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be
misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.
Jean-loup Gailly Mark Adler
[email protected] [email protected]
The data format used by the zlib library is described by RFCs (Request for
Comments) 1950 to 1952 in the files ftp://ds.internic.net/rfc/rfc1950.txt
(zlib format), rfc1951.txt (deflate format) and rfc1952.txt (gzip format).
*/
#ifndef _ZLIB_H
#define _ZLIB_H
#include "zconf.h"
#ifdef __cplusplus
extern "C" {
#endif
#define ZLIB_VERSION "1.1.4"
/*
The 'zlib' compression library provides in-memory compression and
decompression functions, including integrity checks of the uncompressed
data. This version of the library supports only one compression method
(deflation) but other algorithms will be added later and will have the same
stream interface.
Compression can be done in a single step if the buffers are large
enough (for example if an input file is mmap'ed), or can be done by
repeated calls of the compression function. In the latter case, the
application must provide more input and/or consume the output
(providing more output space) before each call.
The library also supports reading and writing files in gzip (.gz) format
with an interface similar to that of stdio.
The library does not install any signal handler. The decoder checks
the consistency of the compressed data, so the library should never
crash even in case of corrupted input.
*/
typedef voidpf (*alloc_func) OF((voidpf opaque, uInt items, uInt size));
typedef void (*free_func) OF((voidpf opaque, voidpf address));
struct internal_state;
typedef struct z_stream_s {
Bytef *next_in; /* next input byte */
uInt avail_in; /* number of bytes available at next_in */
uLong total_in; /* total nb of input bytes read so far */
Bytef *next_out; /* next output byte should be put there */
uInt avail_out; /* remaining free space at next_out */
uLong total_out; /* total nb of bytes output so far */
const char *msg; /* last error message, NULL if no error */
struct internal_state FAR *state; /* not visible by applications */
alloc_func zalloc; /* used to allocate the internal state */
free_func zfree; /* used to free the internal state */
voidpf opaque; /* private data object passed to zalloc and zfree */
int data_type; /* best guess about the data type: ascii or binary */
uLong adler; /* adler32 value of the uncompressed data */
uLong reserved; /* reserved for future use */
} z_stream;
typedef z_stream FAR *z_streamp;
/*
The application must update next_in and avail_in when avail_in has
dropped to zero. It must update next_out and avail_out when avail_out
has dropped to zero. The application must initialize zalloc, zfree and
opaque before calling the init function. All other fields are set by the
compression library and must not be updated by the application.
The opaque value provided by the application will be passed as the first
parameter for calls of zalloc and zfree. This can be useful for custom
memory management. The compression library attaches no meaning to the
opaque value.
zalloc must return Z_NULL if there is not enough memory for the object.
If zlib is used in a multi-threaded application, zalloc and zfree must be
thread safe.
On 16-bit systems, the functions zalloc and zfree must be able to allocate
exactly 65536 bytes, but will not be required to allocate more than this
if the symbol MAXSEG_64K is defined (see zconf.h). WARNING: On MSDOS,
pointers returned by zalloc for objects of exactly 65536 bytes *must*
have their offset normalized to zero. The default allocation function
provided by this library ensures this (see zutil.c). To reduce memory
requirements and avoid any allocation of 64K objects, at the expense of
compression ratio, compile the library with -DMAX_WBITS=14 (see zconf.h).
The fields total_in and total_out can be used for statistics or
progress reports. After compression, total_in holds the total size of
the uncompressed data and may be saved for use in the decompressor
(particularly if the decompressor wants to decompress everything in
a single step).
*/
/* constants */
#define Z_NO_FLUSH 0
#define Z_PARTIAL_FLUSH 1 /* will be removed, use Z_SYNC_FLUSH instead */
#define Z_SYNC_FLUSH 2
#define Z_FULL_FLUSH 3
#define Z_FINISH 4
/* Allowed flush values; see deflate() below for details */
#define Z_OK 0
#define Z_STREAM_END 1
#define Z_NEED_DICT 2
#define Z_ERRNO (-1)
#define Z_STREAM_ERROR (-2)
#define Z_DATA_ERROR (-3)
#define Z_MEM_ERROR (-4)
#define Z_BUF_ERROR (-5)
#define Z_VERSION_ERROR (-6)
/* Return codes for the compression/decompression functions. Negative
* values are errors, positive values are used for special but normal events.
*/
#define Z_NO_COMPRESSION 0
#define Z_BEST_SPEED 1
#define Z_BEST_COMPRESSION 9
#define Z_DEFAULT_COMPRESSION (-1)
/* compression levels */
#define Z_FILTERED 1
#define Z_HUFFMAN_ONLY 2
#define Z_DEFAULT_STRATEGY 0
/* compression strategy; see deflateInit2() below for details */
#define Z_BINARY 0
#define Z_ASCII 1
#define Z_UNKNOWN 2
/* Possible values of the data_type field */
#define Z_DEFLATED 8
/* The deflate compression method (the only one supported in this version) */
#define Z_NULL 0 /* for initializing zalloc, zfree, opaque */
#define zlib_version zlibVersion()
/* for compatibility with versions < 1.0.2 */
/* basic functions */
ZEXTERN const char * ZEXPORT zlibVersion OF((void));
/* The application can compare zlibVersion and ZLIB_VERSION for consistency.
If the first character differs, the library code actually used is
not compatible with the zlib.h header file used by the application.
This check is automatically made by deflateInit and inflateInit.
*/
/*
ZEXTERN int ZEXPORT deflateInit OF((z_streamp strm, int level));
Initializes the internal stream state for compression. The fields
zalloc, zfree and opaque must be initialized before by the caller.
If zalloc and zfree are set to Z_NULL, deflateInit updates them to
use default allocation functions.
The compression level must be Z_DEFAULT_COMPRESSION, or between 0 and 9:
1 gives best speed, 9 gives best compression, 0 gives no compression at
all (the input data is simply copied a block at a time).
Z_DEFAULT_COMPRESSION requests a default compromise between speed and
compression (currently equivalent to level 6).
deflateInit returns Z_OK if success, Z_MEM_ERROR if there was not
enough memory, Z_STREAM_ERROR if level is not a valid compression level,
Z_VERSION_ERROR if the zlib library version (zlib_version) is incompatible
with the version assumed by the caller (ZLIB_VERSION).
msg is set to null if there is no error message. deflateInit does not
perform any compression: this will be done by deflate().
*/
ZEXTERN int ZEXPORT deflate OF((z_streamp strm, int flush));
/*
deflate compresses as much data as possible, and stops when the input
buffer becomes empty or the output buffer becomes full. It may introduce some
output latency (reading input without producing any output) except when
forced to flush.
The detailed semantics are as follows. deflate performs one or both of the
following actions:
- Compress more input starting at next_in and update next_in and avail_in
accordingly. If not all input can be processed (because there is not
enough room in the output buffer), next_in and avail_in are updated and
processing will resume at this point for the next call of deflate().
- Provide more output starting at next_out and update next_out and avail_out
accordingly. This action is forced if the parameter flush is non zero.
Forcing flush frequently degrades the compression ratio, so this parameter
should be set only when necessary (in interactive applications).
Some output may be provided even if flush is not set.
Before the call of deflate(), the application should ensure that at least
one of the actions is possible, by providing more input and/or consuming
more output, and updating avail_in or avail_out accordingly; avail_out
should never be zero before the call. The application can consume the
compressed output when it wants, for example when the output buffer is full
(avail_out == 0), or after each call of deflate(). If deflate returns Z_OK
and with zero avail_out, it must be called again after making room in the
output buffer because there might be more output pending.
If the parameter flush is set to Z_SYNC_FLUSH, all pending output is
flushed to the output buffer and the output is aligned on a byte boundary, so
that the decompressor can get all input data available so far. (In particular
avail_in is zero after the call if enough output space has been provided
before the call.) Flushing may degrade compression for some compression
algorithms and so it should be used only when necessary.
If flush is set to Z_FULL_FLUSH, all output is flushed as with
Z_SYNC_FLUSH, and the compression state is reset so that decompression can
restart from this point if previous compressed data has been damaged or if
random access is desired. Using Z_FULL_FLUSH too often can seriously degrade
the compression.
If deflate returns with avail_out == 0, this function must be called again
with the same value of the flush parameter and more output space (updated
avail_out), until the flush is complete (deflate returns with non-zero
avail_out).
If the parameter flush is set to Z_FINISH, pending input is processed,
pending output is flushed and deflate returns with Z_STREAM_END if there
was enough output space; if deflate returns with Z_OK, this function must be
called again with Z_FINISH and more output space (updated avail_out) but no
more input data, until it returns with Z_STREAM_END or an error. After
deflate has returned Z_STREAM_END, the only possible operations on the
stream are deflateReset or deflateEnd.
Z_FINISH can be used immediately after deflateInit if all the compression
is to be done in a single step. In this case, avail_out must be at least
0.1% larger than avail_in plus 12 bytes. If deflate does not return
Z_STREAM_END, then it must be called again as described above.
deflate() sets strm->adler to the adler32 checksum of all input read
so far (that is, total_in bytes).
deflate() may update data_type if it can make a good guess about
the input data type (Z_ASCII or Z_BINARY). In doubt, the data is considered
binary. This field is only for information purposes and does not affect
the compression algorithm in any manner.
deflate() returns Z_OK if some progress has been made (more input
processed or more output produced), Z_STREAM_END if all input has been
consumed and all output has been produced (only when flush is set to
Z_FINISH), Z_STREAM_ERROR if the stream state was inconsistent (for example
if next_in or next_out was NULL), Z_BUF_ERROR if no progress is possible
(for example avail_in or avail_out was zero).
*/
ZEXTERN int ZEXPORT deflateEnd OF((z_streamp strm));
/*
All dynamically allocated data structures for this stream are freed.
This function discards any unprocessed input and does not flush any
pending output.
deflateEnd returns Z_OK if success, Z_STREAM_ERROR if the
stream state was inconsistent, Z_DATA_ERROR if the stream was freed
prematurely (some input or output was discarded). In the error case,
msg may be set but then points to a static string (which must not be
deallocated).
*/
/*
ZEXTERN int ZEXPORT inflateInit OF((z_streamp strm));
Initializes the internal stream state for decompression. The fields
next_in, avail_in, zalloc, zfree and opaque must be initialized before by
the caller. If next_in is not Z_NULL and avail_in is large enough (the exact
value depends on the compression method), inflateInit determines the
compression method from the zlib header and allocates all data structures
accordingly; otherwise the allocation will be deferred to the first call of
inflate. If zalloc and zfree are set to Z_NULL, inflateInit updates them to
use default allocation functions.
inflateInit returns Z_OK if success, Z_MEM_ERROR if there was not enough
memory, Z_VERSION_ERROR if the zlib library version is incompatible with the
version assumed by the caller. msg is set to null if there is no error
message. inflateInit does not perform any decompression apart from reading
the zlib header if present: this will be done by inflate(). (So next_in and
avail_in may be modified, but next_out and avail_out are unchanged.)
*/
ZEXTERN int ZEXPORT inflate OF((z_streamp strm, int flush));
/*
inflate decompresses as much data as possible, and stops when the input
buffer becomes empty or the output buffer becomes full. It may some
introduce some output latency (reading input without producing any output)
except when forced to flush.
The detailed semantics are as follows. inflate performs one or both of the
following actions:
- Decompress more input starting at next_in and update next_in and avail_in
accordingly. If not all input can be processed (because there is not
enough room in the output buffer), next_in is updated and processing
will resume at this point for the next call of inflate().
- Provide more output starting at next_out and update next_out and avail_out
accordingly. inflate() provides as much output as possible, until there
is no more input data or no more space in the output buffer (see below
about the flush parameter).
Before the call of inflate(), the application should ensure that at least
one of the actions is possible, by providing more input and/or consuming
more output, and updating the next_* and avail_* values accordingly.
The application can consume the uncompressed output when it wants, for
example when the output buffer is full (avail_out == 0), or after each
call of inflate(). If inflate returns Z_OK and with zero avail_out, it
must be called again after making room in the output buffer because there
might be more output pending.
If the parameter flush is set to Z_SYNC_FLUSH, inflate flushes as much
output as possible to the output buffer. The flushing behavior of inflate is
not specified for values of the flush parameter other than Z_SYNC_FLUSH
and Z_FINISH, but the current implementation actually flushes as much output
as possible anyway.
inflate() should normally be called until it returns Z_STREAM_END or an
error. However if all decompression is to be performed in a single step
(a single call of inflate), the parameter flush should be set to
Z_FINISH. In this case all pending input is processed and all pending
output is flushed; avail_out must be large enough to hold all the
uncompressed data. (The size of the uncompressed data may have been saved
by the compressor for this purpose.) The next operation on this stream must
be inflateEnd to deallocate the decompression state. The use of Z_FINISH
is never required, but can be used to inform inflate that a faster routine
may be used for the single inflate() call.
If a preset dictionary is needed at this point (see inflateSetDictionary
below), inflate sets strm-adler to the adler32 checksum of the
dictionary chosen by the compressor and returns Z_NEED_DICT; otherwise
it sets strm->adler to the adler32 checksum of all output produced
so far (that is, total_out bytes) and returns Z_OK, Z_STREAM_END or
an error code as described below. At the end of the stream, inflate()
checks that its computed adler32 checksum is equal to that saved by the
compressor and returns Z_STREAM_END only if the checksum is correct.
inflate() returns Z_OK if some progress has been made (more input processed
or more output produced), Z_STREAM_END if the end of the compressed data has
been reached and all uncompressed output has been produced, Z_NEED_DICT if a
preset dictionary is needed at this point, Z_DATA_ERROR if the input data was
corrupted (input stream not conforming to the zlib format or incorrect
adler32 checksum), Z_STREAM_ERROR if the stream structure was inconsistent
(for example if next_in or next_out was NULL), Z_MEM_ERROR if there was not
enough memory, Z_BUF_ERROR if no progress is possible or if there was not
enough room in the output buffer when Z_FINISH is used. In the Z_DATA_ERROR
case, the application may then call inflateSync to look for a good
compression block.
*/
ZEXTERN int ZEXPORT inflateEnd OF((z_streamp strm));
/*
All dynamically allocated data structures for this stream are freed.
This function discards any unprocessed input and does not flush any
pending output.
inflateEnd returns Z_OK if success, Z_STREAM_ERROR if the stream state
was inconsistent. In the error case, msg may be set but then points to a
static string (which must not be deallocated).
*/
/* Advanced functions */
/*
The following functions are needed only in some special applications.
*/
/*
ZEXTERN int ZEXPORT deflateInit2 OF((z_streamp strm,
int level,
int method,
int windowBits,
int memLevel,
int strategy));
This is another version of deflateInit with more compression options. The
fields next_in, zalloc, zfree and opaque must be initialized before by
the caller.
The method parameter is the compression method. It must be Z_DEFLATED in
this version of the library.
The windowBits parameter is the base two logarithm of the window size
(the size of the history buffer). It should be in the range 8..15 for this
version of the library. Larger values of this parameter result in better
compression at the expense of memory usage. The default value is 15 if
deflateInit is used instead.
The memLevel parameter specifies how much memory should be allocated
for the internal compression state. memLevel=1 uses minimum memory but
is slow and reduces compression ratio; memLevel=9 uses maximum memory
for optimal speed. The default value is 8. See zconf.h for total memory
usage as a function of windowBits and memLevel.
The strategy parameter is used to tune the compression algorithm. Use the
value Z_DEFAULT_STRATEGY for normal data, Z_FILTERED for data produced by a
filter (or predictor), or Z_HUFFMAN_ONLY to force Huffman encoding only (no
string match). Filtered data consists mostly of small values with a
somewhat random distribution. In this case, the compression algorithm is
tuned to compress them better. The effect of Z_FILTERED is to force more
Huffman coding and less string matching; it is somewhat intermediate
between Z_DEFAULT and Z_HUFFMAN_ONLY. The strategy parameter only affects
the compression ratio but not the correctness of the compressed output even
if it is not set appropriately.
deflateInit2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
memory, Z_STREAM_ERROR if a parameter is invalid (such as an invalid
method). msg is set to null if there is no error message. deflateInit2 does
not perform any compression: this will be done by deflate().
*/
ZEXTERN int ZEXPORT deflateSetDictionary OF((z_streamp strm,
const Bytef *dictionary,
uInt dictLength));
/*
Initializes the compression dictionary from the given byte sequence
without producing any compressed output. This function must be called
immediately after deflateInit, deflateInit2 or deflateReset, before any
call of deflate. The compressor and decompressor must use exactly the same
dictionary (see inflateSetDictionary).
The dictionary should consist of strings (byte sequences) that are likely
to be encountered later in the data to be compressed, with the most commonly
used strings preferably put towards the end of the dictionary. Using a
dictionary is most useful when the data to be compressed is short and can be
predicted with good accuracy; the data can then be compressed better than
with the default empty dictionary.
Depending on the size of the compression data structures selected by
deflateInit or deflateInit2, a part of the dictionary may in effect be
discarded, for example if the dictionary is larger than the window size in
deflate or deflate2. Thus the strings most likely to be useful should be
put at the end of the dictionary, not at the front.
Upon return of this function, strm->adler is set to the Adler32 value
of the dictionary; the decompressor may later use this value to determine
which dictionary has been used by the compressor. (The Adler32 value
applies to the whole dictionary even if only a subset of the dictionary is
actually used by the compressor.)
deflateSetDictionary returns Z_OK if success, or Z_STREAM_ERROR if a
parameter is invalid (such as NULL dictionary) or the stream state is
inconsistent (for example if deflate has already been called for this stream
or if the compression method is bsort). deflateSetDictionary does not
perform any compression: this will be done by deflate().
*/
ZEXTERN int ZEXPORT deflateCopy OF((z_streamp dest,
z_streamp source));
/*
Sets the destination stream as a complete copy of the source stream.
This function can be useful when several compression strategies will be
tried, for example when there are several ways of pre-processing the input
data with a filter. The streams that will be discarded should then be freed
by calling deflateEnd. Note that deflateCopy duplicates the internal
compression state which can be quite large, so this strategy is slow and
can consume lots of memory.
deflateCopy returns Z_OK if success, Z_MEM_ERROR if there was not
enough memory, Z_STREAM_ERROR if the source stream state was inconsistent
(such as zalloc being NULL). msg is left unchanged in both source and
destination.
*/
ZEXTERN int ZEXPORT deflateReset OF((z_streamp strm));
/*
This function is equivalent to deflateEnd followed by deflateInit,
but does not free and reallocate all the internal compression state.
The stream will keep the same compression level and any other attributes
that may have been set by deflateInit2.
deflateReset returns Z_OK if success, or Z_STREAM_ERROR if the source
stream state was inconsistent (such as zalloc or state being NULL).
*/
ZEXTERN int ZEXPORT deflateParams OF((z_streamp strm,
int level,
int strategy));
/*
Dynamically update the compression level and compression strategy. The
interpretation of level and strategy is as in deflateInit2. This can be
used to switch between compression and straight copy of the input data, or
to switch to a different kind of input data requiring a different
strategy. If the compression level is changed, the input available so far
is compressed with the old level (and may be flushed); the new level will
take effect only at the next call of deflate().
Before the call of deflateParams, the stream state must be set as for
a call of deflate(), since the currently available input may have to
be compressed and flushed. In particular, strm->avail_out must be non-zero.
deflateParams returns Z_OK if success, Z_STREAM_ERROR if the source
stream state was inconsistent or if a parameter was invalid, Z_BUF_ERROR
if strm->avail_out was zero.
*/
/*
ZEXTERN int ZEXPORT inflateInit2 OF((z_streamp strm,
int windowBits));
This is another version of inflateInit with an extra parameter. The
fields next_in, avail_in, zalloc, zfree and opaque must be initialized
before by the caller.
The windowBits parameter is the base two logarithm of the maximum window
size (the size of the history buffer). It should be in the range 8..15 for
this version of the library. The default value is 15 if inflateInit is used
instead. If a compressed stream with a larger window size is given as
input, inflate() will return with the error code Z_DATA_ERROR instead of
trying to allocate a larger window.
inflateInit2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
memory, Z_STREAM_ERROR if a parameter is invalid (such as a negative
memLevel). msg is set to null if there is no error message. inflateInit2
does not perform any decompression apart from reading the zlib header if
present: this will be done by inflate(). (So next_in and avail_in may be
modified, but next_out and avail_out are unchanged.)
*/
ZEXTERN int ZEXPORT inflateSetDictionary OF((z_streamp strm,
const Bytef *dictionary,
uInt dictLength));
/*
Initializes the decompression dictionary from the given uncompressed byte
sequence. This function must be called immediately after a call of inflate
if this call returned Z_NEED_DICT. The dictionary chosen by the compressor
can be determined from the Adler32 value returned by this call of
inflate. The compressor and decompressor must use exactly the same
dictionary (see deflateSetDictionary).
inflateSetDictionary returns Z_OK if success, Z_STREAM_ERROR if a
parameter is invalid (such as NULL dictionary) or the stream state is
inconsistent, Z_DATA_ERROR if the given dictionary doesn't match the
expected one (incorrect Adler32 value). inflateSetDictionary does not
perform any decompression: this will be done by subsequent calls of
inflate().
*/
ZEXTERN int ZEXPORT inflateSync OF((z_streamp strm));
/*
Skips invalid compressed data until a full flush point (see above the
description of deflate with Z_FULL_FLUSH) can be found, or until all
available input is skipped. No output is provided.
inflateSync returns Z_OK if a full flush point has been found, Z_BUF_ERROR
if no more input was provided, Z_DATA_ERROR if no flush point has been found,
or Z_STREAM_ERROR if the stream structure was inconsistent. In the success
case, the application may save the current current value of total_in which
indicates where valid compressed data was found. In the error case, the
application may repeatedly call inflateSync, providing more input each time,
until success or end of the input data.
*/
ZEXTERN int ZEXPORT inflateReset OF((z_streamp strm));
/*
This function is equivalent to inflateEnd followed by inflateInit,
but does not free and reallocate all the internal decompression state.
The stream will keep attributes that may have been set by inflateInit2.
inflateReset returns Z_OK if success, or Z_STREAM_ERROR if the source
stream state was inconsistent (such as zalloc or state being NULL).
*/
/* utility functions */
/*
The following utility functions are implemented on top of the
basic stream-oriented functions. To simplify the interface, some
default options are assumed (compression level and memory usage,
standard memory allocation functions). The source code of these
utility functions can easily be modified if you need special options.
*/
ZEXTERN int ZEXPORT compress OF((Bytef *dest, uLongf *destLen,
const Bytef *source, uLong sourceLen));
/*
Compresses the source buffer into the destination buffer. sourceLen is
the byte length of the source buffer. Upon entry, destLen is the total
size of the destination buffer, which must be at least 0.1% larger than
sourceLen plus 12 bytes. Upon exit, destLen is the actual size of the
compressed buffer.
This function can be used to compress a whole file at once if the
input file is mmap'ed.
compress returns Z_OK if success, Z_MEM_ERROR if there was not
enough memory, Z_BUF_ERROR if there was not enough room in the output
buffer.
*/
ZEXTERN int ZEXPORT compress2 OF((Bytef *dest, uLongf *destLen,
const Bytef *source, uLong sourceLen,
int level));
/*
Compresses the source buffer into the destination buffer. The level
parameter has the same meaning as in deflateInit. sourceLen is the byte
length of the source buffer. Upon entry, destLen is the total size of the
destination buffer, which must be at least 0.1% larger than sourceLen plus
12 bytes. Upon exit, destLen is the actual size of the compressed buffer.
compress2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
memory, Z_BUF_ERROR if there was not enough room in the output buffer,
Z_STREAM_ERROR if the level parameter is invalid.
*/
ZEXTERN int ZEXPORT uncompress OF((Bytef *dest, uLongf *destLen,
const Bytef *source, uLong sourceLen));
/*
Decompresses the source buffer into the destination buffer. sourceLen is
the byte length of the source buffer. Upon entry, destLen is the total
size of the destination buffer, which must be large enough to hold the
entire uncompressed data. (The size of the uncompressed data must have
been saved previously by the compressor and transmitted to the decompressor
by some mechanism outside the scope of this compression library.)
Upon exit, destLen is the actual size of the compressed buffer.
This function can be used to decompress a whole file at once if the
input file is mmap'ed.
uncompress returns Z_OK if success, Z_MEM_ERROR if there was not
enough memory, Z_BUF_ERROR if there was not enough room in the output
buffer, or Z_DATA_ERROR if the input data was corrupted.
*/
typedef voidp gzFile;
ZEXTERN gzFile ZEXPORT gzopen OF((const char *path, const char *mode));
/*
Opens a gzip (.gz) file for reading or writing. The mode parameter
is as in fopen ("rb" or "wb") but can also include a compression level
("wb9") or a strategy: 'f' for filtered data as in "wb6f", 'h' for
Huffman only compression as in "wb1h". (See the description
of deflateInit2 for more information about the strategy parameter.)
gzopen can be used to read a file which is not in gzip format; in this
case gzread will directly read from the file without decompression.
gzopen returns NULL if the file could not be opened or if there was
insufficient memory to allocate the (de)compression state; errno
can be checked to distinguish the two cases (if errno is zero, the
zlib error is Z_MEM_ERROR). */
ZEXTERN gzFile ZEXPORT gzdopen OF((int fd, const char *mode));
/*
gzdopen() associates a gzFile with the file descriptor fd. File
descriptors are obtained from calls like open, dup, creat, pipe or
fileno (in the file has been previously opened with fopen).
The mode parameter is as in gzopen.
The next call of gzclose on the returned gzFile will also close the
file descriptor fd, just like fclose(fdopen(fd), mode) closes the file
descriptor fd. If you want to keep fd open, use gzdopen(dup(fd), mode).
gzdopen returns NULL if there was insufficient memory to allocate
the (de)compression state.
*/
ZEXTERN int ZEXPORT gzsetparams OF((gzFile file, int level, int strategy));
/*
Dynamically update the compression level or strategy. See the description
of deflateInit2 for the meaning of these parameters.
gzsetparams returns Z_OK if success, or Z_STREAM_ERROR if the file was not
opened for writing.
*/
ZEXTERN int ZEXPORT gzread OF((gzFile file, voidp buf, unsigned len));
/*
Reads the given number of uncompressed bytes from the compressed file.
If the input file was not in gzip format, gzread copies the given number
of bytes into the buffer.
gzread returns the number of uncompressed bytes actually read (0 for
end of file, -1 for error). */
ZEXTERN int ZEXPORT gzwrite OF((gzFile file,
const voidp buf, unsigned len));
/*
Writes the given number of uncompressed bytes into the compressed file.
gzwrite returns the number of uncompressed bytes actually written
(0 in case of error).
*/
ZEXTERN int ZEXPORTVA gzprintf OF((gzFile file, const char *format, ...));
/*
Converts, formats, and writes the args to the compressed file under
control of the format string, as in fprintf. gzprintf returns the number of
uncompressed bytes actually written (0 in case of error).
*/
ZEXTERN int ZEXPORT gzputs OF((gzFile file, const char *s));
/*
Writes the given null-terminated string to the compressed file, excluding
the terminating null character.
gzputs returns the number of characters written, or -1 in case of error.
*/
ZEXTERN char * ZEXPORT gzgets OF((gzFile file, char *buf, int len));
/*
Reads bytes from the compressed file until len-1 characters are read, or
a newline character is read and transferred to buf, or an end-of-file
condition is encountered. The string is then terminated with a null
character.
gzgets returns buf, or Z_NULL in case of error.
*/
ZEXTERN int ZEXPORT gzputc OF((gzFile file, int c));
/*
Writes c, converted to an unsigned char, into the compressed file.
gzputc returns the value that was written, or -1 in case of error.
*/
ZEXTERN int ZEXPORT gzgetc OF((gzFile file));
/*
Reads one byte from the compressed file. gzgetc returns this byte
or -1 in case of end of file or error.
*/
ZEXTERN int ZEXPORT gzflush OF((gzFile file, int flush));
/*
Flushes all pending output into the compressed file. The parameter
flush is as in the deflate() function. The return value is the zlib
error number (see function gzerror below). gzflush returns Z_OK if
the flush parameter is Z_FINISH and all output could be flushed.
gzflush should be called only when strictly necessary because it can
degrade compression.
*/
ZEXTERN z_off_t ZEXPORT gzseek OF((gzFile file,
z_off_t offset, int whence));
/*
Sets the starting position for the next gzread or gzwrite on the
given compressed file. The offset represents a number of bytes in the
uncompressed data stream. The whence parameter is defined as in lseek(2);
the value SEEK_END is not supported.
If the file is opened for reading, this function is emulated but can be
extremely slow. If the file is opened for writing, only forward seeks are
supported; gzseek then compresses a sequence of zeroes up to the new
starting position.
gzseek returns the resulting offset location as measured in bytes from
the beginning of the uncompressed stream, or -1 in case of error, in
particular if the file is opened for writing and the new starting position
would be before the current position.
*/
ZEXTERN int ZEXPORT gzrewind OF((gzFile file));
/*
Rewinds the given file. This function is supported only for reading.
gzrewind(file) is equivalent to (int)gzseek(file, 0L, SEEK_SET)
*/
ZEXTERN z_off_t ZEXPORT gztell OF((gzFile file));
/*
Returns the starting position for the next gzread or gzwrite on the
given compressed file. This position represents a number of bytes in the
uncompressed data stream.
gztell(file) is equivalent to gzseek(file, 0L, SEEK_CUR)
*/
ZEXTERN int ZEXPORT gzeof OF((gzFile file));
/*
Returns 1 when EOF has previously been detected reading the given
input stream, otherwise zero.
*/
ZEXTERN int ZEXPORT gzclose OF((gzFile file));
/*
Flushes all pending output if necessary, closes the compressed file
and deallocates all the (de)compression state. The return value is the zlib
error number (see function gzerror below).
*/
ZEXTERN const char * ZEXPORT gzerror OF((gzFile file, int *errnum));
/*
Returns the error message for the last error which occurred on the
given compressed file. errnum is set to zlib error number. If an
error occurred in the file system and not in the compression library,
errnum is set to Z_ERRNO and the application may consult errno
to get the exact error code.
*/
/* checksum functions */
/*
These functions are not related to compression but are exported
anyway because they might be useful in applications using the
compression library.
*/
ZEXTERN uLong ZEXPORT adler32 OF((uLong adler, const Bytef *buf, uInt len));
/*
Update a running Adler-32 checksum with the bytes buf[0..len-1] and
return the updated checksum. If buf is NULL, this function returns
the required initial value for the checksum.
An Adler-32 checksum is almost as reliable as a CRC32 but can be computed
much faster. Usage example:
uLong adler = adler32(0L, Z_NULL, 0);
while (read_buffer(buffer, length) != EOF) {
adler = adler32(adler, buffer, length);
}
if (adler != original_adler) error();
*/
ZEXTERN uLong ZEXPORT crc32 OF((uLong crc, const Bytef *buf, uInt len));
/*
Update a running crc with the bytes buf[0..len-1] and return the updated
crc. If buf is NULL, this function returns the required initial value
for the crc. Pre- and post-conditioning (one's complement) is performed
within this function so it shouldn't be done by the application.
Usage example:
uLong crc = crc32(0L, Z_NULL, 0);
while (read_buffer(buffer, length) != EOF) {
crc = crc32(crc, buffer, length);
}
if (crc != original_crc) error();
*/
/* various hacks, don't look :) */
/* deflateInit and inflateInit are macros to allow checking the zlib version
* and the compiler's view of z_stream:
*/
ZEXTERN int ZEXPORT deflateInit_ OF((z_streamp strm, int level,
const char *version, int stream_size));
ZEXTERN int ZEXPORT inflateInit_ OF((z_streamp strm,
const char *version, int stream_size));
ZEXTERN int ZEXPORT deflateInit2_ OF((z_streamp strm, int level, int method,
int windowBits, int memLevel,
int strategy, const char *version,
int stream_size));
ZEXTERN int ZEXPORT inflateInit2_ OF((z_streamp strm, int windowBits,
const char *version, int stream_size));
#define deflateInit(strm, level) \
deflateInit_((strm), (level), ZLIB_VERSION, sizeof(z_stream))
#define inflateInit(strm) \
inflateInit_((strm), ZLIB_VERSION, sizeof(z_stream))
#define deflateInit2(strm, level, method, windowBits, memLevel, strategy) \
deflateInit2_((strm),(level),(method),(windowBits),(memLevel),\
(strategy), ZLIB_VERSION, sizeof(z_stream))
#define inflateInit2(strm, windowBits) \
inflateInit2_((strm), (windowBits), ZLIB_VERSION, sizeof(z_stream))
#if !defined(_Z_UTIL_H) && !defined(NO_DUMMY_DECL)
struct internal_state {int dummy;}; /* hack for buggy compilers */
#endif
ZEXTERN const char * ZEXPORT zError OF((int err));
ZEXTERN int ZEXPORT inflateSyncPoint OF((z_streamp z));
ZEXTERN const uLongf * ZEXPORT get_crc_table OF((void));
#ifdef __cplusplus
}
#endif
#endif /* _ZLIB_H */
linux/include/zlib/zutil.h
+225
View File
@@ -0,0 +1,225 @@
/* zutil.h -- internal interface and configuration of the compression library
* Copyright (C) 1995-2002 Jean-loup Gailly.
* For conditions of distribution and use, see copyright notice in zlib.h
*/
/* WARNING: this file should *not* be used by applications. It is
part of the implementation of the compression library and is
subject to change. Applications should only use zlib.h.
*/
/* @(#) $Id: zutil.h,v 1.1 2004/03/15 20:35:25 as Exp $ */
#ifndef _Z_UTIL_H
#define _Z_UTIL_H
#include "zlib.h"
#include <linux/string.h>
#define HAVE_MEMCPY
#if 0 // #ifdef STDC
# include <stddef.h>
# include <string.h>
# include <stdlib.h>
#endif
#ifndef __KERNEL__
#ifdef NO_ERRNO_H
extern int errno;
#else
# include <errno.h>
#endif
#endif
#ifndef local
# define local static
#endif
/* compile with -Dlocal if your debugger can't find static symbols */
typedef unsigned char uch;
typedef uch FAR uchf;
typedef unsigned short ush;
typedef ush FAR ushf;
typedef unsigned long ulg;
extern const char *z_errmsg[10]; /* indexed by 2-zlib_error */
/* (size given to avoid silly warnings with Visual C++) */
#define ERR_MSG(err) z_errmsg[Z_NEED_DICT-(err)]
#define ERR_RETURN(strm,err) \
return (strm->msg = ERR_MSG(err), (err))
/* To be used only when the state is known to be valid */
/* common constants */
#ifndef DEF_WBITS
# define DEF_WBITS MAX_WBITS
#endif
/* default windowBits for decompression. MAX_WBITS is for compression only */
#if MAX_MEM_LEVEL >= 8
# define DEF_MEM_LEVEL 8
#else
# define DEF_MEM_LEVEL MAX_MEM_LEVEL
#endif
/* default memLevel */
#define STORED_BLOCK 0
#define STATIC_TREES 1
#define DYN_TREES 2
/* The three kinds of block type */
#define MIN_MATCH 3
#define MAX_MATCH 258
/* The minimum and maximum match lengths */
#define PRESET_DICT 0x20 /* preset dictionary flag in zlib header */
/* target dependencies */
#ifdef MSDOS
# define OS_CODE 0x00
# if defined(__TURBOC__) || defined(__BORLANDC__)
# if(__STDC__ == 1) && (defined(__LARGE__) || defined(__COMPACT__))
/* Allow compilation with ANSI keywords only enabled */
void _Cdecl farfree( void *block );
void *_Cdecl farmalloc( unsigned long nbytes );
# else
# include <alloc.h>
# endif
# else /* MSC or DJGPP */
# include <malloc.h>
# endif
#endif
#ifdef OS2
# define OS_CODE 0x06
#endif
#ifdef WIN32 /* Window 95 & Windows NT */
# define OS_CODE 0x0b
#endif
#if defined(VAXC) || defined(VMS)
# define OS_CODE 0x02
# define F_OPEN(name, mode) \
fopen((name), (mode), "mbc=60", "ctx=stm", "rfm=fix", "mrs=512")
#endif
#ifdef AMIGA
# define OS_CODE 0x01
#endif
#if defined(ATARI) || defined(atarist)
# define OS_CODE 0x05
#endif
#if defined(MACOS) || defined(TARGET_OS_MAC)
# define OS_CODE 0x07
# if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os
# include <unix.h> /* for fdopen */
# else
# ifndef fdopen
# define fdopen(fd,mode) NULL /* No fdopen() */
# endif
# endif
#endif
#ifdef __50SERIES /* Prime/PRIMOS */
# define OS_CODE 0x0F
#endif
#ifdef TOPS20
# define OS_CODE 0x0a
#endif
#if defined(_BEOS_) || defined(RISCOS)
# define fdopen(fd,mode) NULL /* No fdopen() */
#endif
#if (defined(_MSC_VER) && (_MSC_VER > 600))
# define fdopen(fd,type) _fdopen(fd,type)
#endif
/* Common defaults */
#ifndef OS_CODE
# define OS_CODE 0x03 /* assume Unix */
#endif
#ifndef F_OPEN
# define F_OPEN(name, mode) fopen((name), (mode))
#endif
/* functions */
#ifdef HAVE_STRERROR
extern char *strerror OF((int));
# define zstrerror(errnum) strerror(errnum)
#else
# define zstrerror(errnum) ""
#endif
#if defined(pyr)
# define NO_MEMCPY
#endif
#if defined(SMALL_MEDIUM) && !defined(_MSC_VER) && !defined(__SC__)
/* Use our own functions for small and medium model with MSC <= 5.0.
* You may have to use the same strategy for Borland C (untested).
* The __SC__ check is for Symantec.
*/
# define NO_MEMCPY
#endif
#if defined(STDC) && !defined(HAVE_MEMCPY) && !defined(NO_MEMCPY)
# define HAVE_MEMCPY
#endif
#ifdef HAVE_MEMCPY
# ifdef SMALL_MEDIUM /* MSDOS small or medium model */
# define zmemcpy _fmemcpy
# define zmemcmp _fmemcmp
# define zmemzero(dest, len) _fmemset(dest, 0, len)
# else
# define zmemcpy memcpy
# define zmemcmp memcmp
# define zmemzero(dest, len) memset(dest, 0, len)
# endif
#else
extern void zmemcpy OF((Bytef* dest, const Bytef* source, uInt len));
extern int zmemcmp OF((const Bytef* s1, const Bytef* s2, uInt len));
extern void zmemzero OF((Bytef* dest, uInt len));
#endif
/* Diagnostic functions */
#ifdef DEBUG
# include <stdio.h>
extern int z_verbose;
extern void z_error OF((char *m));
# define Assert(cond,msg) {if(!(cond)) z_error(msg);}
# define Trace(x) {if (z_verbose>=0) fprintf x ;}
# define Tracev(x) {if (z_verbose>0) fprintf x ;}
# define Tracevv(x) {if (z_verbose>1) fprintf x ;}
# define Tracec(c,x) {if (z_verbose>0 && (c)) fprintf x ;}
# define Tracecv(c,x) {if (z_verbose>1 && (c)) fprintf x ;}
#else
# define Assert(cond,msg)
# define Trace(x)
# define Tracev(x)
# define Tracevv(x)
# define Tracec(c,x)
# define Tracecv(c,x)
#endif
typedef uLong (ZEXPORT *check_func) OF((uLong check, const Bytef *buf,
uInt len));
voidpf zcalloc OF((voidpf opaque, unsigned items, unsigned size));
void zcfree OF((voidpf opaque, voidpf ptr));
#define ZALLOC(strm, items, size) \
(*((strm)->zalloc))((strm)->opaque, (items), (size))
#define ZFREE(strm, addr) (*((strm)->zfree))((strm)->opaque, (voidpf)(addr))
#define TRY_FREE(s, p) {if (p) ZFREE(s, p);}
#endif /* _Z_UTIL_H */
linux/lib/libfreeswan/Makefile.objs
+18
View File
@@ -0,0 +1,18 @@
obj-y += ultoa.o
obj-y += addrtoa.o
obj-y += subnettoa.o
obj-y += subnetof.o
obj-y += goodmask.o
obj-y += datatot.o
obj-y += rangetoa.o
obj-y += satoa.o
obj-y += prng.o
obj-y += pfkey_v2_parse.o
obj-y += pfkey_v2_build.o
obj-y += pfkey_v2_debug.o
obj-y += pfkey_v2_ext_bits.o
obj-y += version.o
version.c: ${LIBFREESWANDIR}/version.in.c ${FREESWANSRCDIR}/Makefile.ver
sed '/"/s/xxx/$(IPSECVERSION)/' ${LIBFREESWANDIR}/version.in.c >$@
linux/lib/libfreeswan/addrtoa.c
+68
View File
@@ -0,0 +1,68 @@
/*
* addresses to ASCII
* Copyright (C) 1998, 1999 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: addrtoa.c,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
#define NBYTES 4 /* bytes in an address */
#define PERBYTE 4 /* three digits plus a dot or NUL */
#define BUFLEN (NBYTES*PERBYTE)
#if BUFLEN != ADDRTOA_BUF
#error "ADDRTOA_BUF in freeswan.h inconsistent with addrtoa() code"
#endif
/*
- addrtoa - convert binary address to ASCII dotted decimal
*/
size_t /* space needed for full conversion */
addrtoa(addr, format, dst, dstlen)
struct in_addr addr;
int format; /* character */
char *dst; /* need not be valid if dstlen is 0 */
size_t dstlen;
{
unsigned long a = ntohl(addr.s_addr);
int i;
size_t n;
unsigned long byte;
char buf[BUFLEN];
char *p;
switch (format) {
case 0:
break;
default:
return 0;
break;
}
p = buf;
for (i = NBYTES-1; i >= 0; i--) {
byte = (a >> (i*8)) & 0xff;
p += ultoa(byte, 10, p, PERBYTE);
if (i != 0)
*(p-1) = '.';
}
n = p - buf;
if (dstlen > 0) {
if (n > dstlen)
buf[dstlen - 1] = '\0';
strcpy(dst, buf);
}
return n;
}
linux/lib/libfreeswan/addrtot.c
+302
View File
@@ -0,0 +1,302 @@
/*
* addresses to text
* Copyright (C) 2000 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: addrtot.c,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
#define IP4BYTES 4 /* bytes in an IPv4 address */
#define PERBYTE 4 /* three digits plus a dot or NUL */
#define IP6BYTES 16 /* bytes in an IPv6 address */
/* forwards */
static size_t normal4(const unsigned char *s, size_t len, char *b, char **dp);
static size_t normal6(const unsigned char *s, size_t len, char *b, char **dp, int squish);
static size_t reverse4(const unsigned char *s, size_t len, char *b, char **dp);
static size_t reverse6(const unsigned char *s, size_t len, char *b, char **dp);
/*
- addrtot - convert binary address to text (dotted decimal or IPv6 string)
*/
size_t /* space needed for full conversion */
addrtot(src, format, dst, dstlen)
const ip_address *src;
int format; /* character */
char *dst; /* need not be valid if dstlen is 0 */
size_t dstlen;
{
const unsigned char *b;
size_t n;
char buf[1+ADDRTOT_BUF+1]; /* :address: */
char *p;
int t = addrtypeof(src);
# define TF(t, f) (((t)<<8) | (f))
n = addrbytesptr(src, &b);
if (n == 0)
return 0;
switch (TF(t, format)) {
case TF(AF_INET, 0):
n = normal4(b, n, buf, &p);
break;
case TF(AF_INET6, 0):
n = normal6(b, n, buf, &p, 1);
break;
case TF(AF_INET, 'Q'):
n = normal4(b, n, buf, &p);
break;
case TF(AF_INET6, 'Q'):
n = normal6(b, n, buf, &p, 0);
break;
case TF(AF_INET, 'r'):
n = reverse4(b, n, buf, &p);
break;
case TF(AF_INET6, 'r'):
n = reverse6(b, n, buf, &p);
break;
default: /* including (AF_INET, 'R') */
return 0;
break;
}
if (dstlen > 0) {
if (dstlen < n)
p[dstlen - 1] = '\0';
strcpy(dst, p);
}
return n;
}
/*
- normal4 - normal IPv4 address-text conversion
*/
static size_t /* size of text, including NUL */
normal4(srcp, srclen, buf, dstp)
const unsigned char *srcp;
size_t srclen;
char *buf; /* guaranteed large enough */
char **dstp; /* where to put result pointer */
{
int i;
char *p;
if (srclen != IP4BYTES) /* "can't happen" */
return 0;
p = buf;
for (i = 0; i < IP4BYTES; i++) {
p += ultot(srcp[i], 10, p, PERBYTE);
if (i != IP4BYTES - 1)
*(p-1) = '.'; /* overwrites the NUL */
}
*dstp = buf;
return p - buf;
}
/*
- normal6 - normal IPv6 address-text conversion
*/
static size_t /* size of text, including NUL */
normal6(srcp, srclen, buf, dstp, squish)
const unsigned char *srcp;
size_t srclen;
char *buf; /* guaranteed large enough, plus 2 */
char **dstp; /* where to put result pointer */
int squish; /* whether to squish out 0:0 */
{
int i;
unsigned long piece;
char *p;
char *q;
if (srclen != IP6BYTES) /* "can't happen" */
return 0;
p = buf;
*p++ = ':';
for (i = 0; i < IP6BYTES/2; i++) {
piece = (srcp[2*i] << 8) + srcp[2*i + 1];
p += ultot(piece, 16, p, 5); /* 5 = abcd + NUL */
*(p-1) = ':'; /* overwrites the NUL */
}
*p = '\0';
q = strstr(buf, ":0:0:");
if (squish && q != NULL) { /* zero squishing is possible */
p = q + 1;
while (*p == '0' && *(p+1) == ':')
p += 2;
q++;
*q++ = ':'; /* overwrite first 0 */
while (*p != '\0')
*q++ = *p++;
*q = '\0';
if (!(*(q-1) == ':' && *(q-2) == ':'))
*--q = '\0'; /* strip final : unless :: */
p = buf;
if (!(*p == ':' && *(p+1) == ':'))
p++; /* skip initial : unless :: */
} else {
q = p;
*--q = '\0'; /* strip final : */
p = buf + 1; /* skip initial : */
}
*dstp = p;
return q - p + 1;
}
/*
- reverse4 - IPv4 reverse-lookup conversion
*/
static size_t /* size of text, including NUL */
reverse4(srcp, srclen, buf, dstp)
const unsigned char *srcp;
size_t srclen;
char *buf; /* guaranteed large enough */
char **dstp; /* where to put result pointer */
{
int i;
char *p;
if (srclen != IP4BYTES) /* "can't happen" */
return 0;
p = buf;
for (i = IP4BYTES-1; i >= 0; i--) {
p += ultot(srcp[i], 10, p, PERBYTE);
*(p-1) = '.'; /* overwrites the NUL */
}
strcpy(p, "IN-ADDR.ARPA.");
*dstp = buf;
return strlen(buf) + 1;
}
/*
- reverse6 - IPv6 reverse-lookup conversion (RFC 1886)
* A trifle inefficient, really shouldn't use ultot...
*/
static size_t /* size of text, including NUL */
reverse6(srcp, srclen, buf, dstp)
const unsigned char *srcp;
size_t srclen;
char *buf; /* guaranteed large enough */
char **dstp; /* where to put result pointer */
{
int i;
unsigned long piece;
char *p;
if (srclen != IP6BYTES) /* "can't happen" */
return 0;
p = buf;
for (i = IP6BYTES-1; i >= 0; i--) {
piece = srcp[i];
p += ultot(piece&0xf, 16, p, 2);
*(p-1) = '.';
p += ultot(piece>>4, 16, p, 2);
*(p-1) = '.';
}
strcpy(p, "IP6.ARPA.");
*dstp = buf;
return strlen(buf) + 1;
}
/*
- reverse6 - modern IPv6 reverse-lookup conversion (RFC 2874)
* this version removed as it was obsoleted in the end.
*/
#ifdef ADDRTOT_MAIN
#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
void regress(void);
int
main(int argc, char *argv[])
{
if (argc < 2) {
fprintf(stderr, "Usage: %s {addr|net/mask|begin...end|-r}\n",
argv[0]);
exit(2);
}
if (strcmp(argv[1], "-r") == 0) {
regress();
fprintf(stderr, "regress() returned?!?\n");
exit(1);
}
exit(0);
}
struct rtab {
char *input;
char format;
char *output; /* NULL means error expected */
} rtab[] = {
{"1.2.3.0", 0, "1.2.3.0"},
{"1:2::3:4", 0, "1:2::3:4"},
{"1:2::3:4", 'Q', "1:2:0:0:0:0:3:4"},
{"1:2:0:0:3:4:0:0", 0, "1:2::3:4:0:0"},
{"1.2.3.4", 'r' , "4.3.2.1.IN-ADDR.ARPA."},
/* 0 1 2 3 4 5 6 7 8 9 a b c d e f 0 1 2 3 4 5 6 7 8 9 a b c d e f */
{"1:2::3:4", 'r', "4.0.0.0.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.1.0.0.0.IP6.ARPA."},
{NULL, 0, NULL}
};
void
regress()
{
struct rtab *r;
int status = 0;
ip_address a;
char in[100];
char buf[100];
const char *oops;
size_t n;
for (r = rtab; r->input != NULL; r++) {
strcpy(in, r->input);
/* convert it *to* internal format */
oops = ttoaddr(in, strlen(in), 0, &a);
/* now convert it back */
n = addrtot(&a, r->format, buf, sizeof(buf));
if (n == 0 && r->output == NULL)
{} /* okay, error expected */
else if (n == 0) {
printf("`%s' atoasr failed\n", r->input);
status = 1;
} else if (r->output == NULL) {
printf("`%s' atoasr succeeded unexpectedly '%c'\n",
r->input, r->format);
status = 1;
} else {
if (strcasecmp(r->output, buf) != 0) {
printf("`%s' '%c' gave `%s', expected `%s'\n",
r->input, r->format, buf, r->output);
status = 1;
}
}
}
exit(status);
}
#endif /* ADDRTOT_MAIN */
linux/lib/libfreeswan/addrtypeof.c
+94
View File
@@ -0,0 +1,94 @@
/*
* extract parts of an ip_address
* Copyright (C) 2000 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: addrtypeof.c,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
/*
- addrtypeof - get the type of an ip_address
*/
int
addrtypeof(src)
const ip_address *src;
{
return src->u.v4.sin_family;
}
/*
- addrbytesptr - get pointer to the address bytes of an ip_address
*/
size_t /* 0 for error */
addrbytesptr(src, dstp)
const ip_address *src;
const unsigned char **dstp; /* NULL means just a size query */
{
const unsigned char *p;
size_t n;
switch (src->u.v4.sin_family) {
case AF_INET:
p = (const unsigned char *)&src->u.v4.sin_addr.s_addr;
n = 4;
break;
case AF_INET6:
p = (const unsigned char *)&src->u.v6.sin6_addr;
n = 16;
break;
default:
return 0;
break;
}
if (dstp != NULL)
*dstp = p;
return n;
}
/*
- addrlenof - get length of the address bytes of an ip_address
*/
size_t /* 0 for error */
addrlenof(src)
const ip_address *src;
{
return addrbytesptr(src, NULL);
}
/*
- addrbytesof - get the address bytes of an ip_address
*/
size_t /* 0 for error */
addrbytesof(src, dst, dstlen)
const ip_address *src;
unsigned char *dst;
size_t dstlen;
{
const unsigned char *p;
size_t n;
size_t ncopy;
n = addrbytesptr(src, &p);
if (n == 0)
return 0;
if (dstlen > 0) {
ncopy = n;
if (ncopy > dstlen)
ncopy = dstlen;
memcpy(dst, p, ncopy);
}
return n;
}
linux/lib/libfreeswan/anyaddr.3
+87
View File
@@ -0,0 +1,87 @@
.TH IPSEC_ANYADDR 3 "8 Sept 2000"
.\" RCSID $Id: anyaddr.3,v 1.1 2004/03/15 20:35:25 as Exp $
.SH NAME
ipsec anyaddr \- get "any" address
.br
ipsec isanyaddr \- test address for equality to "any" address
.br
ipsec unspecaddr \- get "unspecified" address
.br
ipsec isunspecaddr \- test address for equality to "unspecified" address
.br
ipsec loopbackaddr \- get loopback address
.br
ipsec isloopbackaddr \- test address for equality to loopback address
.SH SYNOPSIS
.B "#include <freeswan.h>
.sp
.B "const char *anyaddr(int af, ip_address *dst);"
.br
.B "int isanyaddr(const ip_address *src);"
.br
.B "const char *unspecaddr(int af, ip_address *dst);"
.br
.B "int isunspecaddr(const ip_address *src);"
.br
.B "const char *loopbackaddr(int af, ip_address *dst);"
.br
.B "int isloopbackaddr(const ip_address *src);"
.SH DESCRIPTION
These functions fill in, and test for, special values of the
.I ip_address
type.
.PP
.I Anyaddr
fills in the destination
.I *dst
with the ``any'' address of address family
.IR af
(normally
.B AF_INET
or
.BR AF_INET6 ).
The IPv4 ``any'' address is the one embodied in the old
.B INADDR_ANY
macro.
.PP
.I Isanyaddr
returns
.B 1
if the
.I src
address equals the ``any'' address,
and
.B 0
otherwise.
.PP
Similarly,
.I unspecaddr
supplies, and
.I isunspecaddr
tests for,
the ``unspecified'' address,
which may be the same as the ``any'' address.
.PP
Similarly,
.I loopbackaddr
supplies, and
.I islookbackaddr
tests for,
the loopback address.
.PP
.IR Anyaddr ,
.IR unspecaddr ,
and
.I loopbackaddr
return
.B NULL
for success and
a pointer to a string-literal error message for failure;
see DIAGNOSTICS.
.SH SEE ALSO
inet(3), ipsec_addrtot(3), ipsec_sameaddr(3)
.SH DIAGNOSTICS
Fatal errors in the address-supplying functions are:
unknown address family.
.SH HISTORY
Written for the FreeS/WAN project by Henry Spencer.
linux/lib/libfreeswan/anyaddr.c
+146
View File
@@ -0,0 +1,146 @@
/*
* special addresses
* Copyright (C) 2000 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: anyaddr.c,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
/* these are mostly fallbacks for the no-IPv6-support-in-library case */
#ifndef IN6ADDR_ANY_INIT
#define IN6ADDR_ANY_INIT {{ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 }}
#endif
#ifndef IN6ADDR_LOOPBACK_INIT
#define IN6ADDR_LOOPBACK_INIT {{ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1 }}
#endif
static struct in6_addr v6any = IN6ADDR_ANY_INIT;
static struct in6_addr v6loop = IN6ADDR_LOOPBACK_INIT;
/*
- anyaddr - initialize to the any-address value
*/
err_t /* NULL for success, else string literal */
anyaddr(af, dst)
int af; /* address family */
ip_address *dst;
{
uint32_t v4any = htonl(INADDR_ANY);
switch (af) {
case AF_INET:
return initaddr((unsigned char *)&v4any, sizeof(v4any), af, dst);
break;
case AF_INET6:
return initaddr((unsigned char *)&v6any, sizeof(v6any), af, dst);
break;
default:
return "unknown address family in anyaddr/unspecaddr";
break;
}
}
/*
- unspecaddr - initialize to the unspecified-address value
*/
err_t /* NULL for success, else string literal */
unspecaddr(af, dst)
int af; /* address family */
ip_address *dst;
{
return anyaddr(af, dst);
}
/*
- loopbackaddr - initialize to the loopback-address value
*/
err_t /* NULL for success, else string literal */
loopbackaddr(af, dst)
int af; /* address family */
ip_address *dst;
{
uint32_t v4loop = htonl(INADDR_LOOPBACK);
switch (af) {
case AF_INET:
return initaddr((unsigned char *)&v4loop, sizeof(v4loop), af, dst);
break;
case AF_INET6:
return initaddr((unsigned char *)&v6loop, sizeof(v6loop), af, dst);
break;
default:
return "unknown address family in loopbackaddr";
break;
}
}
/*
- isanyaddr - test for the any-address value
*/
int
isanyaddr(src)
const ip_address *src;
{
uint32_t v4any = htonl(INADDR_ANY);
int cmp;
switch (src->u.v4.sin_family) {
case AF_INET:
cmp = memcmp(&src->u.v4.sin_addr.s_addr, &v4any, sizeof(v4any));
break;
case AF_INET6:
cmp = memcmp(&src->u.v6.sin6_addr, &v6any, sizeof(v6any));
break;
default:
return 0;
break;
}
return (cmp == 0) ? 1 : 0;
}
/*
- isunspecaddr - test for the unspecified-address value
*/
int
isunspecaddr(src)
const ip_address *src;
{
return isanyaddr(src);
}
/*
- isloopbackaddr - test for the loopback-address value
*/
int
isloopbackaddr(src)
const ip_address *src;
{
uint32_t v4loop = htonl(INADDR_LOOPBACK);
int cmp;
switch (src->u.v4.sin_family) {
case AF_INET:
cmp = memcmp(&src->u.v4.sin_addr.s_addr, &v4loop, sizeof(v4loop));
break;
case AF_INET6:
cmp = memcmp(&src->u.v6.sin6_addr, &v6loop, sizeof(v6loop));
break;
default:
return 0;
break;
}
return (cmp == 0) ? 1 : 0;
}
linux/lib/libfreeswan/atoaddr.3
+294
View File
@@ -0,0 +1,294 @@
.TH IPSEC_ATOADDR 3 "11 June 2001"
.\" RCSID $Id: atoaddr.3,v 1.1 2004/03/15 20:35:25 as Exp $
.SH NAME
ipsec atoaddr, addrtoa \- convert Internet addresses to and from ASCII
.br
ipsec atosubnet, subnettoa \- convert subnet/mask ASCII form to and from addresses
.SH SYNOPSIS
.B "#include <freeswan.h>
.sp
.B "const char *atoaddr(const char *src, size_t srclen,"
.ti +1c
.B "struct in_addr *addr);"
.br
.B "size_t addrtoa(struct in_addr addr, int format,"
.ti +1c
.B "char *dst, size_t dstlen);"
.sp
.B "const char *atosubnet(const char *src, size_t srclen,"
.ti +1c
.B "struct in_addr *addr, struct in_addr *mask);"
.br
.B "size_t subnettoa(struct in_addr addr, struct in_addr mask,"
.ti +1c
.B "int format, char *dst, size_t dstlen);"
.SH DESCRIPTION
These functions are obsolete; see
.IR ipsec_ttoaddr (3)
for their replacements.
.PP
.I Atoaddr
converts an ASCII name or dotted-decimal address into a binary address
(in network byte order).
.I Addrtoa
does the reverse conversion, back to an ASCII dotted-decimal address.
.I Atosubnet
and
.I subnettoa
do likewise for the ``address/mask'' ASCII form used to write a
specification of a subnet.
.PP
An address is specified in ASCII as a
dotted-decimal address (e.g.
.BR 1.2.3.4 ),
an eight-digit network-order hexadecimal number with the usual C prefix (e.g.
.BR 0x01020304 ,
which is synonymous with
.BR 1.2.3.4 ),
an eight-digit host-order hexadecimal number with a
.B 0h
prefix (e.g.
.BR 0h01020304 ,
which is synonymous with
.B 1.2.3.4
on a big-endian host and
.B 4.3.2.1
on a little-endian host),
a DNS name to be looked up via
.IR gethostbyname (3),
or an old-style network name to be looked up via
.IR getnetbyname (3).
.PP
A dotted-decimal address may be incomplete, in which case
ASCII-to-binary conversion implicitly appends
as many instances of
.B .0
as necessary to bring it up to four components.
The components of a dotted-decimal address are always taken as
decimal, and leading zeros are ignored.
For example,
.B 10
is synonymous with
.BR 10.0.0.0 ,
and
.B 128.009.000.032
is synonymous with
.BR 128.9.0.32
(the latter example is verbatim from RFC 1166).
The result of
.I addrtoa
is always complete and does not contain leading zeros.
.PP
The letters in
a hexadecimal address may be uppercase or lowercase or any mixture thereof.
Use of hexadecimal addresses is
.B strongly
.BR discouraged ;
they are included only to save hassles when dealing with
the handful of perverted programs which already print
network addresses in hexadecimal.
.PP
DNS names may be complete (optionally terminated with a ``.'')
or incomplete, and are looked up as specified by local system configuration
(see
.IR resolver (5)).
The
.I h_addr
value returned by
.IR gethostbyname (3)
is used,
so with current DNS implementations,
the result when the name corresponds to more than one address is
difficult to predict.
Name lookup resorts to
.IR getnetbyname (3)
only if
.IR gethostbyname (3)
fails.
.PP
A subnet specification is of the form \fInetwork\fB/\fImask\fR.
The
.I network
and
.I mask
can be any form acceptable to
.IR atoaddr .
In addition, the
.I mask
can be a decimal integer (leading zeros ignored) giving a bit count,
in which case
it stands for a mask with that number of high bits on and all others off
(e.g.,
.B 24
means
.BR 255.255.255.0 ).
In any case, the mask must be contiguous
(a sequence of high bits on and all remaining low bits off).
As a special case, the subnet specification
.B %default
is a synonym for
.BR 0.0.0.0/0 .
.PP
.I Atosubnet
ANDs the mask with the address before returning,
so that any non-network bits in the address are turned off
(e.g.,
.B 10.1.2.3/24
is synonymous with
.BR 10.1.2.0/24 ).
.I Subnettoa
generates the decimal-integer-bit-count
form of the mask,
with no leading zeros,
unless the mask is non-contiguous.
.PP
The
.I srclen
parameter of
.I atoaddr
and
.I atosubnet
specifies the length of the ASCII string pointed to by
.IR src ;
it is an error for there to be anything else
(e.g., a terminating NUL) within that length.
As a convenience for cases where an entire NUL-terminated string is
to be converted,
a
.I srclen
value of
.B 0
is taken to mean
.BR strlen(src) .
.PP
The
.I dstlen
parameter of
.I addrtoa
and
.I subnettoa
specifies the size of the
.I dst
parameter;
under no circumstances are more than
.I dstlen
bytes written to
.IR dst .
A result which will not fit is truncated.
.I Dstlen
can be zero, in which case
.I dst
need not be valid and no result is written,
but the return value is unaffected;
in all other cases, the (possibly truncated) result is NUL-terminated.
The
.I freeswan.h
header file defines constants,
.B ADDRTOA_BUF
and
.BR SUBNETTOA_BUF ,
which are the sizes of buffers just large enough for worst-case results.
.PP
The
.I format
parameter of
.I addrtoa
and
.I subnettoa
specifies what format is to be used for the conversion.
The value
.B 0
(not the ASCII character
.BR '0' ,
but a zero value)
specifies a reasonable default,
and is in fact the only format currently available.
This parameter is a hedge against future needs.
.PP
The ASCII-to-binary functions return NULL for success and
a pointer to a string-literal error message for failure;
see DIAGNOSTICS.
The binary-to-ASCII functions return
.B 0
for a failure, and otherwise
always return the size of buffer which would
be needed to
accommodate the full conversion result, including terminating NUL;
it is the caller's responsibility to check this against the size of
the provided buffer to determine whether truncation has occurred.
.SH SEE ALSO
inet(3)
.SH DIAGNOSTICS
Fatal errors in
.I atoaddr
are:
empty input;
attempt to allocate temporary storage for a very long name failed;
name lookup failed;
syntax error in dotted-decimal form;
dotted-decimal component too large to fit in 8 bits.
.PP
Fatal errors in
.I atosubnet
are:
no
.B /
in
.IR src ;
.I atoaddr
error in conversion of
.I network
or
.IR mask ;
bit-count mask too big;
mask non-contiguous.
.PP
Fatal errors in
.I addrtoa
and
.I subnettoa
are:
unknown format.
.SH HISTORY
Written for the FreeS/WAN project by Henry Spencer.
.SH BUGS
The interpretation of incomplete dotted-decimal addresses
(e.g.
.B 10/24
means
.BR 10.0.0.0/24 )
differs from that of some older conversion
functions, e.g. those of
.IR inet (3).
The behavior of the older functions has never been
particularly consistent or particularly useful.
.PP
Ignoring leading zeros in dotted-decimal components and bit counts
is arguably the most useful behavior in this application,
but it might occasionally cause confusion with the historical use of leading
zeros to denote octal numbers.
.PP
It is barely possible that somebody, somewhere,
might have a legitimate use for non-contiguous subnet masks.
.PP
.IR Getnetbyname (3)
is a historical dreg.
.PP
The restriction of ASCII-to-binary error reports to literal strings
(so that callers don't need to worry about freeing them or copying them)
does limit the precision of error reporting.
.PP
The ASCII-to-binary error-reporting convention lends itself
to slightly obscure code,
because many readers will not think of NULL as signifying success.
A good way to make it clearer is to write something like:
.PP
.RS
.nf
.B "const char *error;"
.sp
.B "error = atoaddr( /* ... */ );"
.B "if (error != NULL) {"
.B " /* something went wrong */"
.fi
.RE
linux/lib/libfreeswan/atoaddr.c
+238
View File
@@ -0,0 +1,238 @@
/*
* conversion from ASCII forms of addresses to internal ones
* Copyright (C) 1998, 1999 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: atoaddr.c,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
/*
* Define NOLEADINGZEROS to interpret 032 as an error, not as 32. There
* is deliberately no way to interpret it as 26 (i.e., as octal).
*/
/*
* Legal characters in a domain name. Underscore technically is not,
* but is a common misunderstanding.
*/
static const char namechars[] = "abcdefghijklmnopqrstuvwxyz0123456789"
"ABCDEFGHIJKLMNOPQRSTUVWXYZ-_.";
static const char *try8hex(const char *, size_t, struct in_addr *);
static const char *try8hosthex(const char *, size_t, struct in_addr *);
static const char *trydotted(const char *, size_t, struct in_addr *);
static const char *getbyte(const char **, const char *, int *);
/*
- atoaddr - convert ASCII name or dotted-decimal address to binary address
*/
const char * /* NULL for success, else string literal */
atoaddr(src, srclen, addrp)
const char *src;
size_t srclen; /* 0 means "apply strlen" */
struct in_addr *addrp;
{
struct hostent *h;
struct netent *ne = NULL;
const char *oops;
# define HEXLEN 10 /* strlen("0x11223344") */
# ifndef ATOADDRBUF
# define ATOADDRBUF 100
# endif
char namebuf[ATOADDRBUF];
char *p = namebuf;
char *q;
if (srclen == 0)
srclen = strlen(src);
if (srclen == 0)
return "empty string";
/* might it be hex? */
if (srclen == HEXLEN && *src == '0' && CIEQ(*(src+1), 'x'))
return try8hex(src+2, srclen-2, addrp);
if (srclen == HEXLEN && *src == '0' && CIEQ(*(src+1), 'h'))
return try8hosthex(src+2, srclen-2, addrp);
/* try it as dotted decimal */
oops = trydotted(src, srclen, addrp);
if (oops == NULL)
return NULL; /* it worked */
if (*oops != '?')
return oops; /* it *was* probably meant as a d.q. */
/* try it as a name -- first, NUL-terminate it */
if (srclen > sizeof(namebuf)-1) {
p = (char *) MALLOC(srclen+1);
if (p == NULL)
return "unable to allocate temporary space for name";
}
p[0] = '\0';
strncat(p, src, srclen);
/* next, check that it's a vaguely legal name */
for (q = p; *q != '\0'; q++)
if (!isprint(*q))
return "unprintable character in name";
if (strspn(p, namechars) != srclen)
return "illegal (non-DNS-name) character in name";
/* try as host name, failing that as /etc/networks network name */
h = gethostbyname(p);
if (h == NULL)
ne = getnetbyname(p);
if (p != namebuf)
FREE(p);
if (h == NULL && ne == NULL)
return "name lookup failed";
if (h != NULL)
memcpy(&addrp->s_addr, h->h_addr, sizeof(addrp->s_addr));
else
addrp->s_addr = htonl(ne->n_net);
return NULL;
}
/*
- try8hosthex - try conversion as an eight-digit host-order hex number
*/
const char * /* NULL for success, else string literal */
try8hosthex(src, srclen, addrp)
const char *src;
size_t srclen; /* should be 8 */
struct in_addr *addrp;
{
const char *oops;
unsigned long addr;
if (srclen != 8)
return "internal error, try8hex called with bad length";
oops = atoul(src, srclen, 16, &addr);
if (oops != NULL)
return oops;
addrp->s_addr = addr;
return NULL;
}
/*
- try8hex - try conversion as an eight-digit network-order hex number
*/
const char * /* NULL for success, else string literal */
try8hex(src, srclen, addrp)
const char *src;
size_t srclen; /* should be 8 */
struct in_addr *addrp;
{
const char *oops;
oops = try8hosthex(src, srclen, addrp);
if (oops != NULL)
return oops;
addrp->s_addr = htonl(addrp->s_addr);
return NULL;
}
/*
- trydotted - try conversion as dotted decimal
*
* If the first char of a complaint is '?', that means "didn't look like
* dotted decimal at all".
*/
const char * /* NULL for success, else string literal */
trydotted(src, srclen, addrp)
const char *src;
size_t srclen;
struct in_addr *addrp;
{
const char *stop = src + srclen; /* just past end */
int byte;
const char *oops;
unsigned long addr;
int i;
# define NBYTES 4
# define BYTE 8
addr = 0;
for (i = 0; i < NBYTES && src < stop; i++) {
oops = getbyte(&src, stop, &byte);
if (oops != NULL) {
if (*oops != '?')
return oops; /* bad number */
if (i > 1)
return oops+1; /* failed number */
return oops; /* with leading '?' */
}
addr = (addr << BYTE) | byte;
if (i < 3 && src < stop && *src++ != '.') {
if (i == 0)
return "?syntax error in dotted-decimal address";
else
return "syntax error in dotted-decimal address";
}
}
addr <<= (NBYTES - i) * BYTE;
if (src != stop)
return "extra garbage on end of dotted-decimal address";
addrp->s_addr = htonl(addr);
return NULL;
}
/*
- getbyte - try to scan a byte in dotted decimal
* A subtlety here is that all this arithmetic on ASCII digits really is
* highly portable -- ANSI C guarantees that digits 0-9 are contiguous.
* It's easier to just do it ourselves than set up for a call to atoul().
*
* If the first char of a complaint is '?', that means "didn't look like a
* number at all".
*/
const char * /* NULL for success, else string literal */
getbyte(srcp, stop, retp)
const char **srcp; /* *srcp is updated */
const char *stop; /* first untouchable char */
int *retp; /* return-value pointer */
{
char c;
const char *p;
int no;
if (*srcp >= stop)
return "?empty number in dotted-decimal address";
if (stop - *srcp >= 3 && **srcp == '0' && CIEQ(*(*srcp+1), 'x'))
return "hex numbers not supported in dotted-decimal addresses";
#ifdef NOLEADINGZEROS
if (stop - *srcp >= 2 && **srcp == '0' && isdigit(*(*srcp+1)))
return "octal numbers not supported in dotted-decimal addresses";
#endif /* NOLEADINGZEROS */
/* must be decimal, if it's numeric at all */
no = 0;
p = *srcp;
while (p < stop && no <= 255 && (c = *p) >= '0' && c <= '9') {
no = no*10 + (c - '0');
p++;
}
if (p == *srcp)
return "?non-numeric component in dotted-decimal address";
*srcp = p;
if (no > 255)
return "byte overflow in dotted-decimal address";
*retp = no;
return NULL;
}
linux/lib/libfreeswan/atoasr.3
+186
View File
@@ -0,0 +1,186 @@
.TH IPSEC_ATOASR 3 "11 June 2001"
.\" RCSID $Id: atoasr.3,v 1.1 2004/03/15 20:35:25 as Exp $
.SH NAME
ipsec atoasr \- convert ASCII to Internet address, subnet, or range
.br
ipsec rangetoa \- convert Internet address range to ASCII
.SH SYNOPSIS
.B "#include <freeswan.h>
.sp
.B "const char *atoasr(const char *src, size_t srclen,"
.ti +1c
.B "char *type, struct in_addr *addrs);"
.br
.B "size_t rangetoa(struct in_addr *addrs, int format,
.ti +1c
.B "char *dst, size_t dstlen);"
.SH DESCRIPTION
These functions are obsolete;
there is no current equivalent,
because so far they have not proved useful.
.PP
.I Atoasr
converts an ASCII address, subnet, or address range
into a suitable combination of binary addresses
(in network byte order).
.I Rangetoa
converts an address range back into ASCII,
using dotted-decimal form for the addresses
(the other reverse conversions are handled by
.IR ipsec_addrtoa (3)
and
.IR ipsec_subnettoa (3)).
.PP
A single address can be any form acceptable to
.IR ipsec_atoaddr (3):
dotted decimal, DNS name, or hexadecimal number.
A subnet
specification uses the form \fInetwork\fB/\fImask\fR
interpreted by
.IR ipsec_atosubnet (3).
.PP
An address range is two
.IR ipsec_atoaddr (3)
addresses separated by a
.B ...
delimiter.
If there are four dots rather than three, the first is taken as
part of the begin address,
e.g. for a complete DNS name which ends with
.B .
to suppress completion attempts.
The begin address of a range must be
less than or equal to the end address.
.PP
The
.I srclen
parameter of
.I atoasr
specifies the length of the ASCII string pointed to by
.IR src ;
it is an error for there to be anything else
(e.g., a terminating NUL) within that length.
As a convenience for cases where an entire NUL-terminated string is
to be converted,
a
.I srclen
value of
.B 0
is taken to mean
.BR strlen(src) .
.PP
The
.I type
parameter of
.I atoasr
must point to a
.B char
variable used to record which form was found.
The
.I addrs
parameter must point to a two-element array of
.B "struct in_addr"
which receives the results.
The values stored into
.BR *type ,
and the corresponding values in the array, are:
.PP
.ta 3c +2c +3c
*type addrs[0] addrs[1]
.sp 0.8
address \&\fB'a'\fR address -
.br
subnet \&\fB's'\fR network mask
.br
range \&\fB'r'\fR begin end
.PP
The
.I dstlen
parameter of
.I rangetoa
specifies the size of the
.I dst
parameter;
under no circumstances are more than
.I dstlen
bytes written to
.IR dst .
A result which will not fit is truncated.
.I Dstlen
can be zero, in which case
.I dst
need not be valid and no result is written,
but the return value is unaffected;
in all other cases, the (possibly truncated) result is NUL-terminated.
The
.I freeswan.h
header file defines a constant,
.BR RANGETOA_BUF ,
which is the size of a buffer just large enough for worst-case results.
.PP
The
.I format
parameter of
.I rangetoa
specifies what format is to be used for the conversion.
The value
.B 0
(not the ASCII character
.BR '0' ,
but a zero value)
specifies a reasonable default,
and is in fact the only format currently available.
This parameter is a hedge against future needs.
.PP
.I Atoasr
returns NULL for success and
a pointer to a string-literal error message for failure;
see DIAGNOSTICS.
.I Rangetoa
returns
.B 0
for a failure, and otherwise
always returns the size of buffer which would
be needed to
accommodate the full conversion result, including terminating NUL;
it is the caller's responsibility to check this against the size of
the provided buffer to determine whether truncation has occurred.
.SH SEE ALSO
ipsec_atoaddr(3), ipsec_atosubnet(3)
.SH DIAGNOSTICS
Fatal errors in
.I atoasr
are:
empty input;
error in
.IR ipsec_atoaddr (3)
or
.IR ipsec_atosubnet (3)
during conversion;
begin address of range exceeds end address.
.PP
Fatal errors in
.I rangetoa
are:
unknown format.
.SH HISTORY
Written for the FreeS/WAN project by Henry Spencer.
.SH BUGS
The restriction of error reports to literal strings
(so that callers don't need to worry about freeing them or copying them)
does limit the precision of error reporting.
.PP
The error-reporting convention lends itself
to slightly obscure code,
because many readers will not think of NULL as signifying success.
A good way to make it clearer is to write something like:
.PP
.RS
.nf
.B "const char *error;"
.sp
.B "error = atoasr( /* ... */ );"
.B "if (error != NULL) {"
.B " /* something went wrong */"
.fi
.RE
linux/lib/libfreeswan/atoasr.c
+212
View File
@@ -0,0 +1,212 @@
/*
* convert from ASCII form of address/subnet/range to binary
* Copyright (C) 1998, 1999 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: atoasr.c,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
/*
- atoasr - convert ASCII to address, subnet, or range
*/
const char * /* NULL for success, else string literal */
atoasr(src, srclen, typep, addrsp)
const char *src;
size_t srclen; /* 0 means "apply strlen" */
char *typep; /* return type code: 'a', 's', 'r' */
struct in_addr addrsp[2];
{
const char *punct;
const char *stop;
const char *oops;
if (srclen == 0)
srclen = strlen(src);
if (srclen == 0)
return "empty string";
/* subnet is easy to spot */
punct = memchr(src, '/', srclen);
if (punct != NULL) {
*typep = 's';
return atosubnet(src, srclen, &addrsp[0], &addrsp[1]);
}
/* try for a range */
stop = src + srclen;
for (punct = src; (punct = memchr(punct, '.', stop - punct)) != NULL;
punct++)
if (stop - punct > 3 && *(punct+1) == '.' && *(punct+2) == '.')
break; /* NOTE BREAK OUT */
if (punct == NULL) {
/* didn't find the range delimiter, must be plain address */
*typep = 'a';
return atoaddr(src, srclen, &addrsp[0]);
}
/* looks like a range */
*typep = 'r';
if (stop - punct > 4 && *(punct+3) == '.')
punct++; /* first dot is trailing dot of name */
oops = atoaddr(src, punct - src, &addrsp[0]);
if (oops != NULL)
return oops;
oops = atoaddr(punct+3, stop - (punct+3), &addrsp[1]);
if (oops != NULL)
return oops;
if (ntohl(addrsp[0].s_addr) > ntohl(addrsp[1].s_addr))
return "invalid range, begin > end";
return NULL;
}
#ifdef ATOASR_MAIN
#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
void regress(void);
int
main(int argc, char *argv[])
{
struct in_addr a[2];
char buf[100];
const char *oops;
size_t n;
char type;
if (argc < 2) {
fprintf(stderr, "Usage: %s {addr|net/mask|begin...end|-r}\n",
argv[0]);
exit(2);
}
if (strcmp(argv[1], "-r") == 0) {
regress();
fprintf(stderr, "regress() returned?!?\n");
exit(1);
}
oops = atoasr(argv[1], 0, &type, a);
if (oops != NULL) {
fprintf(stderr, "%s: conversion failed: %s\n", argv[0], oops);
exit(1);
}
switch (type) {
case 'a':
n = addrtoa(a[0], 0, buf, sizeof(buf));
break;
case 's':
n = subnettoa(a[0], a[1], 0, buf, sizeof(buf));
break;
case 'r':
n = rangetoa(a, 0, buf, sizeof(buf));
break;
default:
fprintf(stderr, "%s: unknown type '%c'\n", argv[0], type);
exit(1);
break;
}
if (n > sizeof(buf)) {
fprintf(stderr, "%s: reverse conversion of ", argv[0]);
fprintf(stderr, "%s ", inet_ntoa(a[0]));
fprintf(stderr, "%s", inet_ntoa(a[1]));
fprintf(stderr, " failed: need %ld bytes, have only %ld\n",
(long)n, (long)sizeof(buf));
exit(1);
}
printf("%s\n", buf);
exit(0);
}
struct rtab {
char *input;
char *output; /* NULL means error expected */
} rtab[] = {
{"1.2.3.0", "1.2.3.0"},
{"1.2.3.0/255.255.255.0", "1.2.3.0/24"},
{"1.2.3.0...1.2.3.5", "1.2.3.0...1.2.3.5"},
{"1.2.3.4.5", NULL},
{"1.2.3.4/", NULL},
{"1.2.3.4...", NULL},
{"1.2.3.4....", NULL},
{"localhost/32", "127.0.0.1/32"},
{"localhost...127.0.0.3", "127.0.0.1...127.0.0.3"},
{"127.0.0.0...localhost", "127.0.0.0...127.0.0.1"},
{"127.0.0.3...localhost", NULL},
{NULL, NULL}
};
void
regress(void)
{
struct rtab *r;
int status = 0;
struct in_addr a[2];
char in[100];
char buf[100];
const char *oops;
size_t n;
char type;
for (r = rtab; r->input != NULL; r++) {
strcpy(in, r->input);
oops = atoasr(in, 0, &type, a);
if (oops != NULL && r->output == NULL)
{} /* okay, error expected */
else if (oops != NULL) {
printf("`%s' atoasr failed: %s\n", r->input, oops);
status = 1;
} else if (r->output == NULL) {
printf("`%s' atoasr succeeded unexpectedly '%c'\n",
r->input, type);
status = 1;
} else {
switch (type) {
case 'a':
n = addrtoa(a[0], 0, buf, sizeof(buf));
break;
case 's':
n = subnettoa(a[0], a[1], 0, buf, sizeof(buf));
break;
case 'r':
n = rangetoa(a, 0, buf, sizeof(buf));
break;
default:
fprintf(stderr, "`%s' unknown type '%c'\n",
r->input, type);
n = 0;
status = 1;
break;
}
if (n > sizeof(buf)) {
printf("`%s' '%c' reverse failed: need %ld\n",
r->input, type, (long)n);
status = 1;
} else if (n > 0 && strcmp(r->output, buf) != 0) {
printf("`%s' '%c' gave `%s', expected `%s'\n",
r->input, type, buf, r->output);
status = 1;
}
}
}
exit(status);
}
#endif /* ATOASR_MAIN */
linux/lib/libfreeswan/atosa.3
+218
View File
@@ -0,0 +1,218 @@
.TH IPSEC_ATOSA 3 "11 June 2001"
.\" RCSID $Id: atosa.3,v 1.1 2004/03/15 20:35:26 as Exp $
.SH NAME
ipsec atosa, satoa \- convert IPsec Security Association IDs to and from ASCII
.SH SYNOPSIS
.B "#include <freeswan.h>
.sp
.B "const char *atosa(const char *src, size_t srclen,"
.ti +1c
.B "struct sa_id *sa);
.br
.B "size_t satoa(struct sa_id sa, int format,"
.ti +1c
.B "char *dst, size_t dstlen);"
.sp
.B "struct sa_id {"
.ti +1c
.B "struct in_addr dst;"
.ti +1c
.B "ipsec_spi_t spi;"
.ti +1c
.B "int proto;"
.br
.B "};"
.SH DESCRIPTION
These functions are obsolete; see
.IR ipsec_ttosa (3)
for their replacements.
.PP
.I Atosa
converts an ASCII Security Association (SA) specifier into an
.B sa_id
structure (containing
a destination-host address
in network byte order,
an SPI number in network byte order, and
a protocol code).
.I Satoa
does the reverse conversion, back to an ASCII SA specifier.
.PP
An SA is specified in ASCII with a mail-like syntax, e.g.
.BR [email protected] .
An SA specifier contains
a protocol prefix (currently
.BR ah ,
.BR esp ,
or
.BR tun ),
an unsigned integer SPI number,
and an IP address.
The SPI number can be decimal or hexadecimal
(with
.B 0x
prefix), as accepted by
.IR ipsec_atoul (3).
The IP address can be any form accepted by
.IR ipsec_atoaddr (3),
e.g. dotted-decimal address or DNS name.
.PP
As a special case, the SA specifier
.B %passthrough
signifies the special SA used to indicate that packets should be
passed through unaltered.
(At present, this is a synonym for
.BR [email protected] ,
but that is subject to change without notice.)
This form is known to both
.I atosa
and
.IR satoa ,
so the internal form of
.B %passthrough
is never visible.
.PP
The
.B <freeswan.h>
header file supplies the
.B sa_id
structure, as well as a data type
.B ipsec_spi_t
which is an unsigned 32-bit integer.
(There is no consistency between kernel and user on what such a type
is called, hence the header hides the differences.)
.PP
The protocol code uses the same numbers that IP does.
For user convenience, given the difficulty in acquiring the exact set of
protocol names used by the kernel,
.B <freeswan.h>
defines the names
.BR SA_ESP ,
.BR SA_AH ,
and
.B SA_IPIP
to have the same values as the kernel names
.BR IPPROTO_ESP ,
.BR IPPROTO_AH ,
and
.BR IPPROTO_IPIP .
.PP
The
.I srclen
parameter of
.I atosa
specifies the length of the ASCII string pointed to by
.IR src ;
it is an error for there to be anything else
(e.g., a terminating NUL) within that length.
As a convenience for cases where an entire NUL-terminated string is
to be converted,
a
.I srclen
value of
.B 0
is taken to mean
.BR strlen(src) .
.PP
The
.I dstlen
parameter of
.I satoa
specifies the size of the
.I dst
parameter;
under no circumstances are more than
.I dstlen
bytes written to
.IR dst .
A result which will not fit is truncated.
.I Dstlen
can be zero, in which case
.I dst
need not be valid and no result is written,
but the return value is unaffected;
in all other cases, the (possibly truncated) result is NUL-terminated.
The
.I freeswan.h
header file defines a constant,
.BR SATOA_BUF ,
which is the size of a buffer just large enough for worst-case results.
.PP
The
.I format
parameter of
.I satoa
specifies what format is to be used for the conversion.
The value
.B 0
(not the ASCII character
.BR '0' ,
but a zero value)
specifies a reasonable default
(currently
lowercase protocol prefix, lowercase hexadecimal SPI, dotted-decimal address).
The value
.B d
causes the SPI to be generated in decimal instead.
.PP
.I Atosa
returns
.B NULL
for success and
a pointer to a string-literal error message for failure;
see DIAGNOSTICS.
.I Satoa
returns
.B 0
for a failure, and otherwise
always returns the size of buffer which would
be needed to
accommodate the full conversion result, including terminating NUL;
it is the caller's responsibility to check this against the size of
the provided buffer to determine whether truncation has occurred.
.SH SEE ALSO
ipsec_atoul(3), ipsec_atoaddr(3), inet(3)
.SH DIAGNOSTICS
Fatal errors in
.I atosa
are:
empty input;
input too small to be a legal SA specifier;
no
.B @
in input;
unknown protocol prefix;
conversion error in
.I atoul
or
.IR atoaddr .
.PP
Fatal errors in
.I satoa
are:
unknown format; unknown protocol code.
.SH HISTORY
Written for the FreeS/WAN project by Henry Spencer.
.SH BUGS
The
.B tun
protocol code is a FreeS/WANism which may eventually disappear.
.PP
The restriction of ASCII-to-binary error reports to literal strings
(so that callers don't need to worry about freeing them or copying them)
does limit the precision of error reporting.
.PP
The ASCII-to-binary error-reporting convention lends itself
to slightly obscure code,
because many readers will not think of NULL as signifying success.
A good way to make it clearer is to write something like:
.PP
.RS
.nf
.B "const char *error;"
.sp
.B "error = atoaddr( /* ... */ );"
.B "if (error != NULL) {"
.B " /* something went wrong */"
.fi
.RE
linux/lib/libfreeswan/atosa.c
+200
View File
@@ -0,0 +1,200 @@
/*
* convert from ASCII form of SA ID to binary
* Copyright (C) 1998, 1999 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: atosa.c,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
static struct satype {
char *prefix;
size_t prelen; /* strlen(prefix) */
int proto;
} satypes[] = {
{ "ah", 2, SA_AH },
{ "esp", 3, SA_ESP },
{ "tun", 3, SA_IPIP },
{ "comp", 4, SA_COMP },
{ NULL, 0, 0, }
};
/*
- atosa - convert ASCII "[email protected]" to SA identifier
*/
const char * /* NULL for success, else string literal */
atosa(src, srclen, sa)
const char *src;
size_t srclen; /* 0 means "apply strlen" */
struct sa_id *sa;
{
const char *at;
const char *addr;
const char *spi = NULL;
struct satype *sat;
unsigned long ul;
const char *oops;
# define MINLEN 5 /* ah0@0 is as short as it can get */
static char ptname[] = PASSTHROUGHNAME;
# define PTNLEN (sizeof(ptname)-1) /* -1 for NUL */
if (srclen == 0)
srclen = strlen(src);
if (srclen == 0)
return "empty string";
if (srclen < MINLEN)
return "string too short to be SA specifier";
if (srclen == PTNLEN && memcmp(src, ptname, PTNLEN) == 0) {
src = PASSTHROUGHIS;
srclen = strlen(src);
}
at = memchr(src, '@', srclen);
if (at == NULL)
return "no @ in SA specifier";
for (sat = satypes; sat->prefix != NULL; sat++)
if (sat->prelen < srclen &&
strncmp(src, sat->prefix, sat->prelen) == 0) {
sa->proto = sat->proto;
spi = src + sat->prelen;
break; /* NOTE BREAK OUT */
}
if (sat->prefix == NULL)
return "SA specifier lacks valid protocol prefix";
if (spi >= at)
return "no SPI in SA specifier";
oops = atoul(spi, at - spi, 13, &ul);
if (oops != NULL)
return oops;
sa->spi = htonl(ul);
addr = at + 1;
oops = atoaddr(addr, srclen - (addr - src), &sa->dst);
if (oops != NULL)
return oops;
return NULL;
}
#ifdef ATOSA_MAIN
#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
void regress(void);
int
main(int argc, char *argv[])
{
struct sa_id sa;
char buf[100];
const char *oops;
size_t n;
if (argc < 2) {
fprintf(stderr, "Usage: %s {ahnnn@aaa|-r}\n", argv[0]);
exit(2);
}
if (strcmp(argv[1], "-r") == 0) {
regress();
fprintf(stderr, "regress() returned?!?\n");
exit(1);
}
oops = atosa(argv[1], 0, &sa);
if (oops != NULL) {
fprintf(stderr, "%s: conversion failed: %s\n", argv[0], oops);
exit(1);
}
n = satoa(sa, 0, buf, sizeof(buf));
if (n > sizeof(buf)) {
fprintf(stderr, "%s: reverse conv of `%d'", argv[0], sa.proto);
fprintf(stderr, "%lu@", (long unsigned int)sa.spi);
fprintf(stderr, "%s", inet_ntoa(sa.dst));
fprintf(stderr, " failed: need %ld bytes, have only %ld\n",
(long)n, (long)sizeof(buf));
exit(1);
}
printf("%s\n", buf);
exit(0);
}
struct rtab {
char *input;
char *output; /* NULL means error expected */
} rtab[] = {
{"[email protected]", "[email protected]"},
{"[email protected]", "[email protected]"},
{"[email protected]", "[email protected]"},
{"", NULL},
{"_", NULL},
{"ah2.2", NULL},
{"[email protected]", NULL},
{"[email protected]", "[email protected]"},
{"[email protected]", NULL},
{"[email protected]", NULL},
{"[email protected]", NULL},
{"[email protected]", NULL},
{"[email protected]", NULL},
{PASSTHROUGHNAME, PASSTHROUGHNAME},
{NULL, NULL}
};
void
regress(void)
{
struct rtab *r;
int status = 0;
struct sa_id sa;
char in[100];
char buf[100];
const char *oops;
size_t n;
for (r = rtab; r->input != NULL; r++) {
strcpy(in, r->input);
oops = atosa(in, 0, &sa);
if (oops != NULL && r->output == NULL)
{} /* okay, error expected */
else if (oops != NULL) {
printf("`%s' atosa failed: %s\n", r->input, oops);
status = 1;
} else if (r->output == NULL) {
printf("`%s' atosa succeeded unexpectedly\n",
r->input);
status = 1;
} else {
n = satoa(sa, 'd', buf, sizeof(buf));
if (n > sizeof(buf)) {
printf("`%s' satoa failed: need %ld\n",
r->input, (long)n);
status = 1;
} else if (strcmp(r->output, buf) != 0) {
printf("`%s' gave `%s', expected `%s'\n",
r->input, buf, r->output);
status = 1;
}
}
}
exit(status);
}
#endif /* ATOSA_MAIN */
linux/lib/libfreeswan/atosubnet.c
+216
View File
@@ -0,0 +1,216 @@
/*
* convert from ASCII form of subnet specification to binary
* Copyright (C) 1998, 1999 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: atosubnet.c,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
#ifndef DEFAULTSUBNET
#define DEFAULTSUBNET "%default"
#endif
/*
- atosubnet - convert ASCII "addr/mask" to address and mask
* Mask can be integer bit count.
*/
const char * /* NULL for success, else string literal */
atosubnet(src, srclen, addrp, maskp)
const char *src;
size_t srclen; /* 0 means "apply strlen" */
struct in_addr *addrp;
struct in_addr *maskp;
{
const char *slash;
const char *mask;
size_t mlen;
const char *oops;
unsigned long bc;
static char def[] = DEFAULTSUBNET;
# define DEFLEN (sizeof(def) - 1) /* -1 for NUL */
static char defis[] = "0/0";
# define DEFILEN (sizeof(defis) - 1)
if (srclen == 0)
srclen = strlen(src);
if (srclen == 0)
return "empty string";
if (srclen == DEFLEN && strncmp(src, def, srclen) == 0) {
src = defis;
srclen = DEFILEN;
}
slash = memchr(src, '/', srclen);
if (slash == NULL)
return "no / in subnet specification";
mask = slash + 1;
mlen = srclen - (mask - src);
oops = atoaddr(src, slash-src, addrp);
if (oops != NULL)
return oops;
oops = atoul(mask, mlen, 10, &bc);
if (oops == NULL) {
/* atoul succeeded, it's a bit-count mask */
if (bc > ABITS)
return "bit-count mask too large";
#ifdef NOLEADINGZEROS
if (mlen > 1 && *mask == '0')
return "octal not allowed in mask";
#endif /* NOLEADINGZEROS */
*maskp = bitstomask((int)bc);
} else {
oops = atoaddr(mask, mlen, maskp);
if (oops != NULL)
return oops;
if (!goodmask(*maskp))
return "non-contiguous mask";
}
addrp->s_addr &= maskp->s_addr;
return NULL;
}
#ifdef ATOSUBNET_MAIN
#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
void regress(void);
int
main(int argc, char *argv[])
{
struct in_addr a;
struct in_addr m;
char buf[100];
const char *oops;
size_t n;
if (argc < 2) {
fprintf(stderr, "Usage: %s {addr/mask|-r}\n", argv[0]);
exit(2);
}
if (strcmp(argv[1], "-r") == 0) {
regress();
fprintf(stderr, "regress() returned?!?\n");
exit(1);
}
oops = atosubnet(argv[1], 0, &a, &m);
if (oops != NULL) {
fprintf(stderr, "%s: conversion failed: %s\n", argv[0], oops);
exit(1);
}
n = subnettoa(a, m, 0, buf, sizeof(buf));
if (n > sizeof(buf)) {
fprintf(stderr, "%s: reverse conversion of ", argv[0]);
fprintf(stderr, "%s/", inet_ntoa(a));
fprintf(stderr, "%s", inet_ntoa(m));
fprintf(stderr, " failed: need %ld bytes, have only %ld\n",
(long)n, (long)sizeof(buf));
exit(1);
}
printf("%s\n", buf);
exit(0);
}
struct rtab {
char *input;
char *output; /* NULL means error expected */
} rtab[] = {
{"1.2.3.0/255.255.255.0", "1.2.3.0/24"},
{"1.2.3.0/24", "1.2.3.0/24"},
{"1.2.3.1/255.255.255.240", "1.2.3.0/28"},
{"1.2.3.1/32", "1.2.3.1/32"},
{"1.2.3.1/0", "0.0.0.0/0"},
/* "1.2.3.1/255.255.127.0", "1.2.3.0/255.255.127.0", */
{"1.2.3.1/255.255.127.0", NULL},
{"128.009.000.032/32", "128.9.0.32/32"},
{"128.0x9.0.32/32", NULL},
{"0x80090020/32", "128.9.0.32/32"},
{"0x800x0020/32", NULL},
{"128.9.0.32/0xffFF0000", "128.9.0.0/16"},
{"128.9.0.32/0xff0000FF", NULL},
{"128.9.0.32/0x0000ffFF", NULL},
{"128.9.0.32/0x00ffFF0000", NULL},
{"128.9.0.32/0xffFF", NULL},
{"128.9.0.32.27/32", NULL},
{"128.9.0k32/32", NULL},
{"328.9.0.32/32", NULL},
{"128.9..32/32", NULL},
{"10/8", "10.0.0.0/8"},
{"10.0/8", "10.0.0.0/8"},
{"10.0.0/8", "10.0.0.0/8"},
{"10.0.1/24", "10.0.1.0/24"},
{"_", NULL},
{"_/_", NULL},
{"1.2.3.1", NULL},
{"1.2.3.1/_", NULL},
{"1.2.3.1/24._", NULL},
{"1.2.3.1/99", NULL},
{"localhost/32", "127.0.0.1/32"},
{"%default", "0.0.0.0/0"},
{NULL, NULL}
};
void
regress()
{
struct rtab *r;
int status = 0;
struct in_addr a;
struct in_addr m;
char in[100];
char buf[100];
const char *oops;
size_t n;
for (r = rtab; r->input != NULL; r++) {
strcpy(in, r->input);
oops = atosubnet(in, 0, &a, &m);
if (oops != NULL && r->output == NULL)
{} /* okay, error expected */
else if (oops != NULL) {
printf("`%s' atosubnet failed: %s\n", r->input, oops);
status = 1;
} else if (r->output == NULL) {
printf("`%s' atosubnet succeeded unexpectedly\n",
r->input);
status = 1;
} else {
n = subnettoa(a, m, 0, buf, sizeof(buf));
if (n > sizeof(buf)) {
printf("`%s' subnettoa failed: need %ld\n",
r->input, (long)n);
status = 1;
} else if (strcmp(r->output, buf) != 0) {
printf("`%s' gave `%s', expected `%s'\n",
r->input, buf, r->output);
status = 1;
}
}
}
exit(status);
}
#endif /* ATOSUBNET_MAIN */
linux/lib/libfreeswan/atoul.3
+161
View File
@@ -0,0 +1,161 @@
.TH IPSEC_ATOUL 3 "11 June 2001"
.\" RCSID $Id: atoul.3,v 1.1 2004/03/15 20:35:26 as Exp $
.SH NAME
ipsec atoul, ultoa \- convert unsigned-long numbers to and from ASCII
.SH SYNOPSIS
.B "#include <freeswan.h>
.sp
.B "const char *atoul(const char *src, size_t srclen,"
.ti +1c
.B "int base, unsigned long *n);"
.br
.B "size_t ultoa(unsigned long n, int base, char *dst,"
.ti +1c
.B "size_t dstlen);"
.SH DESCRIPTION
These functions are obsolete; see
.IR ipsec_ttoul (3)
for their replacements.
.PP
.I Atoul
converts an ASCII number into a binary
.B "unsigned long"
value.
.I Ultoa
does the reverse conversion, back to an ASCII version.
.PP
Numbers are specified in ASCII as
decimal (e.g.
.BR 123 ),
octal with a leading zero (e.g.
.BR 012 ,
which has value 10),
or hexadecimal with a leading
.B 0x
(e.g.
.BR 0x1f ,
which has value 31)
in either upper or lower case.
.PP
The
.I srclen
parameter of
.I atoul
specifies the length of the ASCII string pointed to by
.IR src ;
it is an error for there to be anything else
(e.g., a terminating NUL) within that length.
As a convenience for cases where an entire NUL-terminated string is
to be converted,
a
.I srclen
value of
.B 0
is taken to mean
.BR strlen(src) .
.PP
The
.I base
parameter of
.I atoul
can be
.BR 8 ,
.BR 10 ,
or
.BR 16 ,
in which case the number supplied is assumed to be of that form
(and in the case of
.BR 16 ,
to lack any
.B 0x
prefix).
It can also be
.BR 0 ,
in which case the number is examined for a leading zero
or a leading
.B 0x
to determine its base,
or
.B 13
(halfway between 10 and 16),
which has the same effect as
.B 0
except that a non-hexadecimal
number is considered decimal regardless of any leading zero.
.PP
The
.I dstlen
parameter of
.I ultoa
specifies the size of the
.I dst
parameter;
under no circumstances are more than
.I dstlen
bytes written to
.IR dst .
A result which will not fit is truncated.
.I Dstlen
can be zero, in which case
.I dst
need not be valid and no result is written,
but the return value is unaffected;
in all other cases, the (possibly truncated) result is NUL-terminated.
.PP
The
.I base
parameter of
.I ultoa
must be
.BR 8 ,
.BR 10 ,
or
.BR 16 .
.PP
.I Atoul
returns NULL for success and
a pointer to a string-literal error message for failure;
see DIAGNOSTICS.
.I Ultoa
returns the size of buffer which would
be needed to
accommodate the full conversion result, including terminating NUL;
it is the caller's responsibility to check this against the size of
the provided buffer to determine whether truncation has occurred.
.SH SEE ALSO
atol(3), strtoul(3)
.SH DIAGNOSTICS
Fatal errors in
.I atoul
are:
empty input;
unknown
.IR base ;
non-digit character found;
number too large for an
.BR "unsigned long" .
.SH HISTORY
Written for the FreeS/WAN project by Henry Spencer.
.SH BUGS
There is no provision for reporting an invalid
.I base
parameter given to
.IR ultoa .
.PP
The restriction of error reports to literal strings
(so that callers don't need to worry about freeing them or copying them)
does limit the precision of error reporting.
.PP
The error-reporting convention lends itself to slightly obscure code,
because many readers will not think of NULL as signifying success.
A good way to make it clearer is to write something like:
.PP
.RS
.nf
.B "const char *error;"
.sp
.B "error = atoul( /* ... */ );"
.B "if (error != NULL) {"
.B " /* something went wrong */"
.fi
.RE
linux/lib/libfreeswan/atoul.c
+90
View File
@@ -0,0 +1,90 @@
/*
* convert from ASCII form of unsigned long to binary
* Copyright (C) 1998, 1999 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: atoul.c,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
/*
- atoul - convert ASCII substring to unsigned long number
*/
const char * /* NULL for success, else string literal */
atoul(src, srclen, base, resultp)
const char *src;
size_t srclen; /* 0 means strlen(src) */
int base; /* 0 means figure it out */
unsigned long *resultp;
{
const char *stop;
static char hex[] = "0123456789abcdef";
static char uchex[] = "0123456789ABCDEF";
int d;
char c;
char *p;
unsigned long r;
unsigned long rlimit;
int dlimit;
if (srclen == 0)
srclen = strlen(src);
if (srclen == 0)
return "empty string";
if (base == 0 || base == 13) {
if (srclen > 2 && *src == '0' && CIEQ(*(src+1), 'x'))
return atoul(src+2, srclen-2, 16, resultp);
if (srclen > 1 && *src == '0' && base != 13)
return atoul(src+1, srclen-1, 8, resultp);
return atoul(src, srclen, 10, resultp);
}
if (base != 8 && base != 10 && base != 16)
return "unsupported number base";
r = 0;
stop = src + srclen;
if (base == 16) {
while (src < stop) {
c = *src++;
p = strchr(hex, c);
if (p != NULL)
d = p - hex;
else {
p = strchr(uchex, c);
if (p == NULL)
return "non-hex-digit in hex number";
d = p - uchex;
}
r = (r << 4) | d;
}
/* defer length check to catch invalid digits first */
if (srclen > sizeof(unsigned long) * 2)
return "hex number too long";
} else {
rlimit = ULONG_MAX / base;
dlimit = (int)(ULONG_MAX - rlimit*base);
while (src < stop) {
c = *src++;
d = c - '0';
if (d < 0 || d >= base)
return "non-digit in number";
if (r > rlimit || (r == rlimit && d > dlimit))
return "unsigned-long overflow";
r = r*base + d;
}
}
*resultp = r;
return NULL;
}
linux/lib/libfreeswan/copyright.c
+56
View File
@@ -0,0 +1,56 @@
/*
* return IPsec copyright notice
* Copyright (C) 2001, 2002 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: copyright.c,v 1.6 2005/11/02 21:51:13 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
static const char *co[] = {
"Copyright (C) 1999-2005 Henry Spencer, Richard Guy Briggs,",
" D. Hugh Redelmeier, Sandy Harris, Claudia Schmeing,",
" Michael Richardson, Angelos D. Keromytis, John Ioannidis,",
"",
" Ken Bantoft, Stephen J. Bevan, JuanJo Ciarlante, Mathieu Lafon,",
" Stephane Laroche, Kai Martius, Tuomo Soini, Herbert Xu,",
"",
" Andreas Steffen, Martin Berner, Marco Bertossa, David Buechi,",
" Ueli Galizzi, Christoph Gysin, Andreas Hess, Patric Lichtsteiner,",
" Michael Meier, Andreas Schleiss, Ariane Seiler,",
" Mario Strasser, Lukas Suter, Roger Wegmann, Simon Zwahlen,",
" Zuercher Hochschule Winterthur (Switzerland).",
"",
" Jan Hutter, Martin Willi, Andreas Steffen,",
" Hochschule fuer Technik Rapperswil (Switzerland).",
"",
"This program is free software; you can redistribute it and/or modify it",
"under the terms of the GNU General Public License as published by the",
"Free Software Foundation; either version 2 of the License, or (at your",
"option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.",
"",
"This program is distributed in the hope that it will be useful, but",
"WITHOUT ANY WARRANTY; without even the implied warranty of",
"MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General",
"Public License (file COPYING in the distribution) for more details.",
NULL
};
/*
- ipsec_copyright_notice - return copyright notice, as a vector of strings
*/
const char **
ipsec_copyright_notice()
{
return co;
}
linux/lib/libfreeswan/datatot.c
+233
View File
@@ -0,0 +1,233 @@
/*
* convert from binary data (e.g. key) to text form
* Copyright (C) 2000 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: datatot.c,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
static void convert(const char *src, size_t nreal, int format, char *out);
/*
- datatot - convert data bytes to text
*/
size_t /* true length (with NUL) for success */
datatot(src, srclen, format, dst, dstlen)
const char *src;
size_t srclen;
int format; /* character indicating what format */
char *dst; /* need not be valid if dstlen is 0 */
size_t dstlen;
{
size_t inblocksize; /* process this many bytes at a time */
size_t outblocksize; /* producing this many */
size_t breakevery; /* add a _ every this many (0 means don't) */
size_t sincebreak; /* output bytes since last _ */
char breakchar; /* character used to break between groups */
char inblock[10]; /* enough for any format */
char outblock[10]; /* enough for any format */
char fake[1]; /* fake output area for dstlen == 0 */
size_t needed; /* return value */
char *stop; /* where the terminating NUL will go */
size_t ntodo; /* remaining input */
size_t nreal;
char *out;
char *prefix;
breakevery = 0;
breakchar = '_';
switch (format) {
case 0:
case 'h':
format = 'x';
breakevery = 8;
/* FALLTHROUGH */
case 'x':
inblocksize = 1;
outblocksize = 2;
prefix = "0x";
break;
case ':':
format = 'x';
breakevery = 2;
breakchar = ':';
/* FALLTHROUGH */
case 16:
inblocksize = 1;
outblocksize = 2;
prefix = "";
format = 'x';
break;
case 's':
inblocksize = 3;
outblocksize = 4;
prefix = "0s";
break;
case 64: /* beware, equals ' ' */
inblocksize = 3;
outblocksize = 4;
prefix = "";
format = 's';
break;
default:
return 0;
break;
}
assert(inblocksize < sizeof(inblock));
assert(outblocksize < sizeof(outblock));
assert(breakevery % outblocksize == 0);
if (srclen == 0)
return 0;
ntodo = srclen;
if (dstlen == 0) { /* dispose of awkward special case */
dst = fake;
dstlen = 1;
}
stop = dst + dstlen - 1;
nreal = strlen(prefix);
needed = nreal; /* for starters */
if (dstlen <= nreal) { /* prefix won't fit */
strncpy(dst, prefix, dstlen - 1);
dst += dstlen - 1;
} else {
strcpy(dst, prefix);
dst += nreal;
}
assert(dst <= stop);
sincebreak = 0;
while (ntodo > 0) {
if (ntodo < inblocksize) { /* incomplete input */
memset(inblock, 0, sizeof(inblock));
memcpy(inblock, src, ntodo);
src = inblock;
nreal = ntodo;
ntodo = inblocksize;
} else
nreal = inblocksize;
out = (outblocksize > stop - dst) ? outblock : dst;
convert(src, nreal, format, out);
needed += outblocksize;
sincebreak += outblocksize;
if (dst < stop) {
if (out != dst) {
assert(outblocksize > stop - dst);
memcpy(dst, out, stop - dst);
dst = stop;
} else
dst += outblocksize;
}
src += inblocksize;
ntodo -= inblocksize;
if (breakevery != 0 && sincebreak >= breakevery && ntodo > 0) {
if (dst < stop)
*dst++ = breakchar;
needed++;
sincebreak = 0;
}
}
assert(dst <= stop);
*dst++ = '\0';
needed++;
return needed;
}
/*
- convert - convert one input block to one output block
*/
static void
convert(src, nreal, format, out)
const char *src;
size_t nreal; /* how much of the input block is real */
int format;
char *out;
{
static char hex[] = "0123456789abcdef";
static char base64[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
"abcdefghijklmnopqrstuvwxyz"
"0123456789+/";
unsigned char c;
unsigned char c1, c2, c3;
assert(nreal > 0);
switch (format) {
case 'x':
assert(nreal == 1);
c = (unsigned char)*src;
*out++ = hex[c >> 4];
*out++ = hex[c & 0xf];
break;
case 's':
c1 = (unsigned char)*src++;
c2 = (unsigned char)*src++;
c3 = (unsigned char)*src++;
*out++ = base64[c1 >> 2]; /* top 6 bits of c1 */
c = (c1 & 0x3) << 4; /* bottom 2 of c1... */
c |= c2 >> 4; /* ...top 4 of c2 */
*out++ = base64[c];
if (nreal == 1)
*out++ = '=';
else {
c = (c2 & 0xf) << 2; /* bottom 4 of c2... */
c |= c3 >> 6; /* ...top 2 of c3 */
*out++ = base64[c];
}
if (nreal <= 2)
*out++ = '=';
else
*out++ = base64[c3 & 0x3f]; /* bottom 6 of c3 */
break;
default:
assert(nreal == 0); /* unknown format */
break;
}
}
/*
- datatoa - convert data to ASCII
* backward-compatibility synonym for datatot
*/
size_t /* true length (with NUL) for success */
datatoa(src, srclen, format, dst, dstlen)
const char *src;
size_t srclen;
int format; /* character indicating what format */
char *dst; /* need not be valid if dstlen is 0 */
size_t dstlen;
{
return datatot(src, srclen, format, dst, dstlen);
}
/*
- bytestoa - convert data bytes to ASCII
* backward-compatibility synonym for datatot
*/
size_t /* true length (with NUL) for success */
bytestoa(src, srclen, format, dst, dstlen)
const char *src;
size_t srclen;
int format; /* character indicating what format */
char *dst; /* need not be valid if dstlen is 0 */
size_t dstlen;
{
return datatot(src, srclen, format, dst, dstlen);
}
linux/lib/libfreeswan/goodmask.3
+57
View File
@@ -0,0 +1,57 @@
.TH IPSEC_GOODMASK 3 "11 June 2001"
.\" RCSID $Id: goodmask.3,v 1.1 2004/03/15 20:35:26 as Exp $
.SH NAME
ipsec goodmask \- is this Internet subnet mask a valid one?
.br
ipsec masktobits \- convert Internet subnet mask to bit count
.br
ipsec bitstomask \- convert bit count to Internet subnet mask
.SH SYNOPSIS
.B "#include <freeswan.h>
.sp
.B "int goodmask(struct in_addr mask);"
.br
.B "int masktobits(struct in_addr mask);"
.br
.B "struct in_addr bitstomask(int n);"
.SH DESCRIPTION
These functions are obsolete;
see
.IR ipsec_masktocount (3)
for a partial replacement.
.PP
.I Goodmask
reports whether the subnet
.I mask
is a valid one,
i.e. consists of a (possibly empty) sequence of
.BR 1 s
followed by a (possibly empty) sequence of
.BR 0 s.
.I Masktobits
takes a (valid) subnet mask and returns the number of
.B 1
bits in it.
.I Bitstomask
reverses this,
returning the subnet mask corresponding to bit count
.IR n .
.PP
All masks are in network byte order.
.SH SEE ALSO
inet(3), ipsec_atosubnet(3)
.SH DIAGNOSTICS
.I Masktobits
returns
.B \-1
for an invalid mask.
.I Bitstomask
returns an all-zeros mask for a negative or out-of-range
.IR n .
.SH HISTORY
Written for the FreeS/WAN project by Henry Spencer.
.SH BUGS
The error-reporting convention of
.I bitstomask
is less than ideal;
zero is sometimes a legitimate mask.
linux/lib/libfreeswan/goodmask.c
+97
View File
@@ -0,0 +1,97 @@
/*
* minor utilities for subnet-mask manipulation
* Copyright (C) 1998, 1999 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: goodmask.c,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
/*
- goodmask - is this a good (^1*0*$) subnet mask?
* You are not expected to understand this. See Henry S. Warren Jr,
* "Functions realizable with word-parallel logical and two's-complement
* addition instructions", CACM 20.6 (June 1977), p.439.
*/
int /* predicate */
goodmask(mask)
struct in_addr mask;
{
unsigned long x = ntohl(mask.s_addr);
/* clear rightmost contiguous string of 1-bits */
# define CRCS1B(x) (((x|(x-1))+1)&x)
# define TOPBIT (1UL << 31)
/* either zero, or has one string of 1-bits which is left-justified */
if (x == 0 || (CRCS1B(x) == 0 && (x&TOPBIT)))
return 1;
return 0;
}
/*
- masktobits - how many bits in this mask?
* The algorithm is essentially a binary search, but highly optimized
* for this particular task.
*/
int /* -1 means !goodmask() */
masktobits(mask)
struct in_addr mask;
{
unsigned long m = ntohl(mask.s_addr);
int masklen;
if (!goodmask(mask))
return -1;
if (m&0x00000001UL)
return 32;
masklen = 0;
if (m&(0x0000ffffUL<<1)) { /* <<1 for 1-origin numbering */
masklen |= 0x10;
m <<= 16;
}
if (m&(0x00ff0000UL<<1)) {
masklen |= 0x08;
m <<= 8;
}
if (m&(0x0f000000UL<<1)) {
masklen |= 0x04;
m <<= 4;
}
if (m&(0x30000000UL<<1)) {
masklen |= 0x02;
m <<= 2;
}
if (m&(0x40000000UL<<1))
masklen |= 0x01;
return masklen;
}
/*
- bitstomask - return a mask with this many high bits on
*/
struct in_addr
bitstomask(n)
int n;
{
struct in_addr result;
if (n > 0 && n <= ABITS)
result.s_addr = htonl(~((1UL << (ABITS - n)) - 1));
else if (n == 0)
result.s_addr = 0;
else
result.s_addr = 0; /* best error report we can do */
return result;
}
linux/lib/libfreeswan/initaddr.3
+129
View File
@@ -0,0 +1,129 @@
.TH IPSEC_INITADDR 3 "11 Sept 2000"
.\" RCSID $Id: initaddr.3,v 1.1 2004/03/15 20:35:26 as Exp $
.SH NAME
ipsec initaddr \- initialize an ip_address
.br
ipsec addrtypeof \- get address type of an ip_address
.br
ipsec addrlenof \- get length of address within an ip_address
.br
ipsec addrbytesof \- get copy of address within an ip_address
.br
ipsec addrbytesptr \- get pointer to address within an ip_address
.SH SYNOPSIS
.B "#include <freeswan.h>"
.sp
.B "const char *initaddr(const char *src, size_t srclen,"
.ti +1c
.B "int af, ip_address *dst);"
.br
.B "int addrtypeof(const ip_address *src);"
.br
.B "size_t addrlenof(const ip_address *src);"
.br
.B "size_t addrbytesof(const ip_address *src,"
.ti +1c
.B "unsigned char *dst, size_t dstlen);"
.br
.B "size_t addrbytesptr(const ip_address *src,"
.ti +1c
.B "const unsigned char **dst);"
.SH DESCRIPTION
The
.B <freeswan.h>
library uses an internal type
.I ip_address
to contain one of the (currently two) types of IP address.
These functions provide basic tools for creating and examining this type.
.PP
.I Initaddr
initializes a variable
.I *dst
of type
.I ip_address
from an address
(in network byte order,
indicated by a pointer
.I src
and a length
.IR srclen )
and an address family
.I af
(typically
.B AF_INET
or
.BR AF_INET6 ).
The length must be consistent with the address family.
.PP
.I Addrtypeof
returns the address type of an address,
normally
.B AF_INET
or
.BR AF_INET6 .
(The
.B <freeswan.h>
header file arranges to include the necessary headers for these
names to be known.)
.PP
.I Addrlenof
returns the size (in bytes) of the address within an
.IR ip_address ,
to permit storage allocation etc.
.PP
.I Addrbytesof
copies the address within the
.I ip_address
.I src
to the buffer indicated by the pointer
.I dst
and the length
.IR dstlen ,
and returns the address length (in bytes).
If the address will not fit,
as many bytes as will fit are copied;
the returned length is still the full length.
It is the caller's responsibility to check the
returned value to ensure that there was enough room.
.PP
.I Addrbytesptr
sets
.I *dst
to a pointer to the internal address within the
.IR ip_address ,
and returns the address length (in bytes).
If
.I dst
is
.BR NULL ,
it just returns the address length.
The pointer points to
.B const
to discourage misuse.
.PP
.I Initaddr
returns
.B NULL
for success and
a pointer to a string-literal error message for failure;
see DIAGNOSTICS.
.PP
The functions which return
.I size_t
return
.B 0
for a failure.
.SH SEE ALSO
inet(3), ipsec_ttoaddr(3)
.SH DIAGNOSTICS
An unknown address family is a fatal error for any of these functions
except
.IR addrtypeof .
An address-size mismatch is a fatal error for
.IR initaddr .
.SH HISTORY
Written for the FreeS/WAN project by Henry Spencer.
.SH BUGS
.I Addrtypeof
should probably have been named
.IR addrfamilyof .
linux/lib/libfreeswan/initaddr.c
+51
View File
@@ -0,0 +1,51 @@
/*
* initialize address structure
* Copyright (C) 2000 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: initaddr.c,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
/*
- initaddr - initialize ip_address from bytes
*/
err_t /* NULL for success, else string literal */
initaddr(src, srclen, af, dst)
const unsigned char *src;
size_t srclen;
int af; /* address family */
ip_address *dst;
{
switch (af) {
case AF_INET:
if (srclen != 4)
return "IPv4 address must be exactly 4 bytes";
dst->u.v4.sin_family = af;
dst->u.v4.sin_port = 0; /* unused */
memcpy((char *)&dst->u.v4.sin_addr.s_addr, src, srclen);
break;
case AF_INET6:
if (srclen != 16)
return "IPv6 address must be exactly 16 bytes";
dst->u.v6.sin6_family = af;
dst->u.v6.sin6_flowinfo = 0; /* unused */
dst->u.v6.sin6_port = 0; /* unused */
memcpy((char *)&dst->u.v6.sin6_addr, src, srclen);
break;
default:
return "unknown address family in initaddr";
break;
}
return NULL;
}
linux/lib/libfreeswan/initsaid.c
+33
View File
@@ -0,0 +1,33 @@
/*
* initialize SA ID structure
* Copyright (C) 2000 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: initsaid.c,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
/*
- initsaid - initialize SA ID from bits
*/
void
initsaid(addr, spi, proto, dst)
const ip_address *addr;
ipsec_spi_t spi;
int proto;
ip_said *dst;
{
dst->dst = *addr;
dst->spi = spi;
dst->proto = proto;
}
linux/lib/libfreeswan/initsubnet.3
+137
View File
@@ -0,0 +1,137 @@
.TH IPSEC_INITSUBNET 3 "12 March 2002"
.\" RCSID $Id: initsubnet.3,v 1.1 2004/03/15 20:35:26 as Exp $
.SH NAME
ipsec initsubnet \- initialize an ip_subnet
.br
ipsec addrtosubnet \- initialize a singleton ip_subnet
.br
ipsec subnettypeof \- get address type of an ip_subnet
.br
ipsec masktocount \- convert subnet mask to bit count
.br
ipsec networkof \- get base address of an ip_subnet
.br
ipsec maskof \- get subnet mask of an ip_subnet
.SH SYNOPSIS
.B "#include <freeswan.h>"
.sp
.B "const char *initsubnet(const ip_address *addr,"
.ti +1c
.B "int maskbits, int clash, ip_subnet *dst);"
.br
.B "const char *addrtosubnet(const ip_address *addr,"
.ti +1c
.B "ip_subnet *dst);"
.sp
.B "int subnettypeof(const ip_subnet *src);"
.br
.B "int masktocount(const ip_address *src);"
.br
.B "void networkof(const ip_subnet *src, ip_address *dst);"
.br
.B "void maskof(const ip_subnet *src, ip_address *dst);"
.SH DESCRIPTION
The
.B <freeswan.h>
library uses an internal type
.I ip_subnet
to contain a description of an IP subnet
(base address plus mask).
These functions provide basic tools for creating and examining this type.
.PP
.I Initsubnet
initializes a variable
.I *dst
of type
.I ip_subnet
from a base address and
a count of mask bits.
The
.I clash
parameter specifies what to do if the base address includes
.B 1
bits outside the prefix specified by the mask
(that is, in the ``host number'' part of the address):
.RS
.IP '0' 5
zero out host-number bits
.IP 'x'
non-zero host-number bits are an error
.RE
.PP
.I Initsubnet
returns
.B NULL
for success and
a pointer to a string-literal error message for failure;
see DIAGNOSTICS.
.PP
.I Addrtosubnet
initializes an
.I ip_subnet
variable
.I *dst
to a ``singleton subnet'' containing the single address
.IR *addr .
It returns
.B NULL
for success and
a pointer to a string-literal error message for failure.
.PP
.I Subnettypeof
returns the address type of a subnet,
normally
.B AF_INET
or
.BR AF_INET6 .
(The
.B <freeswan.h>
header file arranges to include the necessary headers for these
names to be known.)
.PP
.I Masktocount
converts a subnet mask, expressed as an address, to a bit count
suitable for use with
.IR initsubnet .
It returns
.B \-1
for error; see DIAGNOSTICS.
.PP
.I Networkof
fills in
.I *dst
with the base address of subnet
.IR src .
.PP
.I Maskof
fills in
.I *dst
with the subnet mask of subnet
.IR src ,
expressed as an address.
.SH SEE ALSO
inet(3), ipsec_ttosubnet(3), ipsec_rangetosubnet(3)
.SH DIAGNOSTICS
Fatal errors in
.I initsubnet
are:
unknown address family;
unknown
.I clash
value;
impossible mask bit count;
non-zero host-number bits and
.I clash
is
.BR 'x' .
Fatal errors in
.I addrtosubnet
are:
unknown address family.
Fatal errors in
.I masktocount
are:
unknown address family;
mask bits not contiguous.
.SH HISTORY
Written for the FreeS/WAN project by Henry Spencer.
linux/lib/libfreeswan/initsubnet.c
+95
View File
@@ -0,0 +1,95 @@
/*
* initialize subnet structure
* Copyright (C) 2000, 2002 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: initsubnet.c,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
/*
- initsubnet - initialize ip_subnet from address and count
*
* The only hard part is checking for host-part bits turned on.
*/
err_t /* NULL for success, else string literal */
initsubnet(addr, count, clash, dst)
const ip_address *addr;
int count;
int clash; /* '0' zero host-part bits, 'x' die on them */
ip_subnet *dst;
{
unsigned char *p;
int n;
int c;
unsigned m;
int die;
dst->addr = *addr;
n = addrbytesptr(&dst->addr, (const unsigned char **)&p);
if (n == 0)
return "unknown address family";
switch (clash) {
case '0':
die = 0;
break;
case 'x':
die = 1;
break;
default:
return "unknown clash-control value in initsubnet";
break;
}
c = count / 8;
if (c > n)
return "impossible mask count";
p += c;
n -= c;
m = 0xff;
c = count % 8;
if (n > 0 && c != 0) /* partial byte */
m >>= c;
for (; n > 0; n--) {
if ((*p & m) != 0) {
if (die)
return "improper subnet, host-part bits on";
*p &= ~m;
}
m = 0xff;
p++;
}
dst->maskbits = count;
return NULL;
}
/*
- addrtosubnet - initialize ip_subnet from a single address
*/
err_t /* NULL for success, else string literal */
addrtosubnet(addr, dst)
const ip_address *addr;
ip_subnet *dst;
{
int n;
dst->addr = *addr;
n = addrbytesptr(&dst->addr, (const unsigned char **)NULL);
if (n == 0)
return "unknown address family";
dst->maskbits = n*8;
return NULL;
}
linux/lib/libfreeswan/internal.h
+81
View File
@@ -0,0 +1,81 @@
/*
* internal definitions for use within the library; do not export!
* Copyright (C) 1998, 1999 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: internal.h,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#ifndef ABITS
#define ABITS 32 /* bits in an IPv4 address */
#endif
/* case-independent ASCII character equality comparison */
#define CIEQ(c1, c2) ( ((c1)&~040) == ((c2)&~040) )
/* syntax for passthrough SA */
#ifndef PASSTHROUGHNAME
#define PASSTHROUGHNAME "%passthrough"
#define PASSTHROUGH4NAME "%passthrough4"
#define PASSTHROUGH6NAME "%passthrough6"
#define PASSTHROUGHIS "[email protected]"
#define PASSTHROUGH4IS "[email protected]"
#define PASSTHROUGH6IS "tun0@::"
#define PASSTHROUGHTYPE "tun"
#define PASSTHROUGHSPI 0
#define PASSTHROUGHDST 0
#endif
/*
* Headers, greatly complicated by stupid and unnecessary inconsistencies
* between the user environment and the kernel environment. These are done
* here so that this mess need exist in only one place.
*
* It may seem like a -I or two could avoid most of this, but on closer
* inspection it is not quite that easy.
*/
/* things that need to come from one place or the other, depending */
#ifdef __KERNEL__
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/string.h>
#include <linux/ctype.h>
#define assert(foo) /* nothing */
#else
#include <sys/types.h>
#include <netinet/in.h>
#include <string.h>
#include <ctype.h>
#include <assert.h>
#endif
/* things that exist only in userland */
#ifndef __KERNEL__
/* You'd think this would be okay in the kernel too -- it's just a */
/* bunch of constants -- but no, in RH5.1 it screws up other things. */
/* (Credit: Mike Warfield tracked this problem down. Thanks Mike!) */
/* Fortunately, we don't need it in the kernel subset of the library. */
#include <limits.h>
/* header files for things that should never be called in kernel */
#include <netdb.h>
/* memory allocation, currently user-only, macro-ized just in case */
#include <stdlib.h>
#define MALLOC(n) malloc(n)
#define FREE(p) free(p)
#endif /* __KERNEL__ */
linux/lib/libfreeswan/keyblobtoid.3
+103
View File
@@ -0,0 +1,103 @@
.TH IPSEC_KEYBLOBTOID 3 "25 March 2002"
.\" RCSID $Id: keyblobtoid.3,v 1.1 2004/03/15 20:35:26 as Exp $
.SH NAME
ipsec keyblobtoid, splitkeytoid \- generate key IDs from RSA keys
.SH SYNOPSIS
.B "#include <freeswan.h>
.sp
.B "size_t keyblobtoid(const unsigned char *blob,"
.ti +1c
.B "size_t bloblen, char *dst, size_t dstlen);"
.br
.B "size_t splitkeytoid(const unsigned char *e, size_t elen,"
.ti +1c
.B "const unsigned char *m, size_t mlen, char *dst,
.ti +1c
.B "size_t dstlen);"
.SH DESCRIPTION
.I Keyblobtoid
and
.I splitkeytoid
generate
key IDs
from RSA keys,
for use in messages and reporting,
writing the result to
.IR dst .
A
.I key ID
is a short ASCII string identifying a key;
currently it is just the first nine characters of the base64
encoding of the RFC 2537/3110 ``byte blob'' representation of the key.
(Beware that no finite key ID can be collision-proof:
there is always some small chance of two random keys having the
same ID.)
.PP
.I Keyblobtoid
generates a key ID from a key which is already in the form of an
RFC 2537/3110 binary key
.I blob
(encoded exponent length, exponent, modulus).
.PP
.I Splitkeytoid
generates a key ID from a key given in the form of a separate
(binary) exponent
.I e
and modulus
.IR m .
.PP
The
.I dstlen
parameter of either
specifies the size of the
.I dst
parameter;
under no circumstances are more than
.I dstlen
bytes written to
.IR dst .
A result which will not fit is truncated.
.I Dstlen
can be zero, in which case
.I dst
need not be valid and no result is written,
but the return value is unaffected;
in all other cases, the (possibly truncated) result is NUL-terminated.
The
.I freeswan.h
header file defines a constant
.B KEYID_BUF
which is the size of a buffer large enough for worst-case results.
.PP
Both functions return
.B 0
for a failure, and otherwise
always return the size of buffer which would
be needed to
accommodate the full conversion result, including terminating NUL;
it is the caller's responsibility to check this against the size of
the provided buffer to determine whether truncation has occurred.
.P
With keys generated by
.IR ipsec_rsasigkey (3),
the first two base64 digits are always the same,
and the third carries only about one bit of information.
It's worse with keys using longer fixed exponents,
e.g. the 24-bit exponent that's common in X.509 certificates.
However, being able to relate key IDs to the full
base64 text form of keys by eye is sufficiently useful that this
waste of space seems justifiable.
The choice of nine digits is a compromise between bulk and
probability of collision.
.SH SEE ALSO
RFC 3110,
\fIRSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)\fR,
Eastlake, 2001
(superseding the older but better-known RFC 2537).
.SH DIAGNOSTICS
Fatal errors are:
key too short to supply enough bits to construct a complete key ID
(almost certainly indicating a garbage key);
exponent too long for its length to be representable.
.SH HISTORY
Written for the FreeS/WAN project by Henry Spencer.
linux/lib/libfreeswan/keyblobtoid.c
+148
View File
@@ -0,0 +1,148 @@
/*
* generate printable key IDs
* Copyright (C) 2002 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: keyblobtoid.c,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
/*
- keyblobtoid - generate a printable key ID from an RFC 2537/3110 key blob
* Current algorithm is just to use first nine base64 digits.
*/
size_t
keyblobtoid(src, srclen, dst, dstlen)
const unsigned char *src;
size_t srclen;
char *dst; /* need not be valid if dstlen is 0 */
size_t dstlen;
{
char buf[KEYID_BUF];
size_t ret;
# define NDIG 9
if (srclen < (NDIG*6 + 7)/8) {
strcpy(buf, "?len= ?");
buf[5] = '0' + srclen;
ret = 0;
} else {
(void) datatot(src, srclen, 64, buf, NDIG+1);
ret = NDIG+1;
}
if (dstlen > 0) {
if (strlen(buf)+1 > dstlen)
*(buf + dstlen - 1) = '\0';
strcpy(dst, buf);
}
return ret;
}
/*
- splitkeytoid - generate a printable key ID from exponent/modulus pair
* Just constructs the beginnings of a key blob and calls keyblobtoid().
*/
size_t
splitkeytoid(e, elen, m, mlen, dst, dstlen)
const unsigned char *e;
size_t elen;
const unsigned char *m;
size_t mlen;
char *dst; /* need not be valid if dstlen is 0 */
size_t dstlen;
{
unsigned char buf[KEYID_BUF]; /* ample room */
unsigned char *bufend = buf + sizeof(buf);
unsigned char *p;
size_t n;
p = buf;
if (elen <= 255)
*p++ = elen;
else if ((elen &~ 0xffff) == 0) {
*p++ = 0;
*p++ = (elen>>8) & 0xff;
*p++ = elen & 0xff;
} else
return 0; /* unrepresentable exponent length */
n = bufend - p;
if (elen < n)
n = elen;
memcpy(p, e, n);
p += n;
n = bufend - p;
if (n > 0) {
if (mlen < n)
n = mlen;
memcpy(p, m, n);
p += n;
}
return keyblobtoid(buf, p - buf, dst, dstlen);
}
#ifdef KEYBLOBTOID_MAIN
#include <stdio.h>
void regress();
int
main(argc, argv)
int argc;
char *argv[];
{
typedef unsigned char uc;
uc hexblob[] = "\x01\x03\x85\xf2\xd6\x76\x9b\x03\x59\xb6\x21\x52";
uc hexe[] = "\x03";
uc hexm[] = "\x85\xf2\xd6\x76\x9b\x03\x59\xb6\x21\x52\xef\x85";
char b64nine[] = "AQOF8tZ2m";
char b64six[] = "AQOF8t";
char buf[100];
size_t n;
char *b = b64nine;
size_t bl = strlen(b) + 1;
int st = 0;
n = keyblobtoid(hexblob, strlen(hexblob), buf, sizeof(buf));
if (n != bl) {
fprintf(stderr, "%s: keyblobtoid returned %d not %d\n",
argv[0], n, bl);
st = 1;
}
if (strcmp(buf, b) != 0) {
fprintf(stderr, "%s: keyblobtoid generated `%s' not `%s'\n",
argv[0], buf, b);
st = 1;
}
n = splitkeytoid(hexe, strlen(hexe), hexm, strlen(hexm), buf,
sizeof(buf));
if (n != bl) {
fprintf(stderr, "%s: splitkeytoid returned %d not %d\n",
argv[0], n, bl);
st = 1;
}
if (strcmp(buf, b) != 0) {
fprintf(stderr, "%s: splitkeytoid generated `%s' not `%s'\n",
argv[0], buf, b);
st = 1;
}
exit(st);
}
#endif /* KEYBLOBTOID_MAIN */
linux/lib/libfreeswan/optionsfrom.3
+182
View File
@@ -0,0 +1,182 @@
.TH IPSEC_OPTIONSFROM 3 "16 Oct 1998"
.\" RCSID $Id: optionsfrom.3,v 1.1 2004/03/15 20:35:26 as Exp $
.SH NAME
ipsec optionsfrom \- read additional ``command-line'' options from file
.SH SYNOPSIS
.B "#include <freeswan.h>
.sp
.B "const char *optionsfrom(char *filename, int *argcp,"
.ti +1c
.B "char ***argvp, int optind, FILE *errsto);"
.SH DESCRIPTION
.I Optionsfrom
is called from within a
.IR getopt_long (3)
scan,
as the result of the appearance of an option (preferably
.BR \-\-optionsfrom )
to insert additional ``command-line'' arguments
into the scan immediately after
the option.
Typically this would be done to pick up options which are
security-sensitive and should not be visible to
.IR ps (1)
and similar commands,
and hence cannot be supplied as part
of the actual command line or the environment.
.PP
.I Optionsfrom
reads the additional arguments from the specified
.IR filename ,
allocates a new argument vector to hold pointers to the existing
arguments plus the new ones,
and amends
.I argc
and
.I argv
(via the pointers
.I argcp
and
.IR argvp ,
which must point to the
.I argc
and
.I argv
being supplied to
.IR getopt_long (3))
accordingly.
.I Optind
must be the index, in the original argument vector,
of the next argument.
.PP
If
.I errsto
is NULL,
.I optionsfrom
returns NULL for success and
a pointer to a string-literal error message for failure;
see DIAGNOSTICS.
If
.I errsto
is non-NULL and an error occurs,
.I optionsfrom
prints a suitable complaint onto the
.I errsto
descriptor and invokes
.I exit
with an exit status of 2;
this is a convenience for cases where more sophisticated
responses are not required.
.PP
The text of existing arguments is not disturbed by
.IR optionsfrom ,
so pointers to them and into them remain valid.
.PP
The file of additional arguments is an ASCII text file.
Lines consisting solely of white space,
and lines beginning with
.BR # ,
are comments and are ignored.
Otherwise, a line which does not begin with
.BR \-
is taken to be a single argument;
if it both begins and ends with double-quote ("),
those quotes are stripped off (note, no other processing is done within
the line!).
A line beginning with
.B \-
is considered to contain multiple arguments separated by white space.
.PP
Because
.I optionsfrom
reads its entire file before the
.IR getopt_long (3)
scan is resumed, an
.I optionsfrom
file can contain another
.B \-\-optionsfrom
option.
Obviously, infinite loops are possible here.
If
.I errsto
is non-NULL,
.I optionsfrom
considers it an error to be called more than 100 times.
If
.I errsto
is NULL,
loop detection is up to the caller
(and the internal loop counter is zeroed out).
.SH EXAMPLE
A reasonable way to invoke
.I optionsfrom
would be like so:
.PP
.nf
.ft B
#include <getopt.h>
struct option opts[] = {
/* ... */
"optionsfrom", 1, NULL, '+',
/* ... */
};
int
main(argc, argv)
int argc;
char *argv[];
{
int opt;
extern char *optarg;
extern int optind;
while ((opt = getopt_long(argc, argv, "", opts, NULL)) != EOF)
switch (opt) {
/* ... */
case '+': /* optionsfrom */
optionsfrom(optarg, &argc, &argv, optind, stderr);
/* does not return on error */
break;
/* ... */
}
/* ... */
.ft
.fi
.SH SEE ALSO
getopt_long(3)
.SH DIAGNOSTICS
Errors in
.I optionsfrom
are:
unable to open file;
attempt to allocate temporary storage for argument or
argument vector failed;
read error in file;
line too long.
.SH HISTORY
Written for the FreeS/WAN project by Henry Spencer.
.SH BUGS
The double-quote convention is rather simplistic.
.PP
Line length is currently limited to 1023 bytes,
and there is no continuation convention.
.PP
The restriction of error reports to literal strings
(so that callers don't need to worry about freeing them or copying them)
does limit the precision of error reporting.
.PP
The error-reporting convention lends itself
to slightly obscure code,
because many readers will not think of NULL as signifying success.
.PP
There is a certain element of unwarranted chumminess with
the insides of
.IR getopt_long (3)
here.
No non-public interfaces are actually used, but
.IR optionsfrom
does rely on
.IR getopt_long (3)
being well-behaved in certain ways that are not actually
promised by the specs.
linux/lib/libfreeswan/optionsfrom.c
+301
View File
@@ -0,0 +1,301 @@
/*
* pick up more options from a file, in the middle of an option scan
* Copyright (C) 1998, 1999 Henry Spencer.
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: optionsfrom.c,v 1.1 2004/03/15 20:35:26 as Exp $
*/
#include "internal.h"
#include "freeswan.h"
#include <stdio.h>
#define MAX 100 /* loop-detection limit */
/* internal work area */
struct work {
# define LOTS 1024
char buf[LOTS];
char *line;
char *pending;
};
static const char *dowork(const char *, int *, char ***, int);
static const char *getanarg(FILE *, struct work *, char **);
static char *getline(FILE *, char *, size_t);
/*
- optionsfrom - add some options, taken from a file, to argc/argv
* If errsto is non-NULL, does not return in event of error.
*/
const char * /* NULL for success, else string literal */
optionsfrom(filename, argcp, argvp, optind, errsto)
const char *filename;
int *argcp; /* pointer to argc */
char ***argvp; /* pointer to argv */
int optind; /* current optind, number of next argument */
FILE *errsto; /* where to report errors (NULL means return) */
{
const char *e;
static int nuses = 0;
if (errsto != NULL) {
nuses++;
if (nuses >= MAX) {
fprintf(errsto,
"%s: optionsfrom called %d times, looping?\n",
(*argvp)[0], nuses);
exit(2);
}
} else
nuses = 0;
e = dowork(filename, argcp, argvp, optind);
if (e != NULL && errsto != NULL) {
fprintf(errsto, "%s: optionsfrom failed: %s\n", (*argvp)[0], e);
exit(2);
}
return e;
}
/*
- dowork - do all the real work of optionsfrom
* Does not alter the existing arguments, but does relocate and alter
* the argv pointer vector.
*/
static const char * /* NULL for success, else string literal */
dowork(filename, argcp, argvp, optind)
const char *filename;
int *argcp; /* pointer to argc */
char ***argvp; /* pointer to argv */
int optind; /* current optind, number of next argument */
{
char **newargv;
char **tmp;
int newargc;
int next; /* place for next argument */
int room; /* how many more new arguments we can hold */
# define SOME 10 /* first guess at how many we'll need */
FILE *f;
int i;
const char *p;
struct work wa; /* for getanarg() */
f = fopen(filename, "r");
if (f == NULL)
return "unable to open file";
newargc = *argcp + SOME;
newargv = malloc((newargc+1) * sizeof(char *));
if (newargv == NULL)
return "unable to allocate memory";
memcpy(newargv, *argvp, optind * sizeof(char *));
room = SOME;
next = optind;
newargv[next] = NULL;
wa.pending = NULL;
while ((p = getanarg(f, &wa, &newargv[next])) == NULL) {
if (room == 0) {
newargc += SOME;
tmp = realloc(newargv, (newargc+1) * sizeof(char *));
if (tmp == NULL) {
p = "out of space for new argv";
break; /* NOTE BREAK OUT */
}
newargv = tmp;
room += SOME;
}
next++;
room--;
}
if (p != NULL && !feof(f)) { /* error of some kind */
for (i = optind+1; i <= next; i++)
if (newargv[i] != NULL)
free(newargv[i]);
free(newargv);
fclose(f);
return p;
}
fclose(f);
memcpy(newargv + next, *argvp + optind,
(*argcp+1-optind) * sizeof(char *));
*argcp += next - optind;
*argvp = newargv;
return NULL;
}
/*
- getanarg - get a malloced argument from the file
*/
static const char * /* NULL for success, else string literal */
getanarg(f, w, linep)
FILE *f;
struct work *w;
char **linep; /* where to store pointer if successful */
{
size_t len;
char *p;
char *endp;
while (w->pending == NULL) { /* no pending line */
if ((w->line = getline(f, w->buf, sizeof(w->buf))) == NULL)
return "error in line read"; /* caller checks EOF */
if (w->line[0] != '#' &&
*(w->line + strspn(w->line, " \t")) != '\0')
w->pending = w->line;
}
if (w->pending == w->line && w->line[0] != '-') {
/* fresh plain line */
w->pending = NULL;
p = w->line;
endp = p + strlen(p);
if (*p == '"' && endp > p+1 && *(endp-1) == '"') {
p++;
endp--;
*endp = '\0';
}
if (w->line == w->buf) {
*linep = malloc(endp - p + 1);
if (*linep == NULL)
return "out of memory for new line";
strcpy(*linep, p);
} else /* getline already malloced it */
*linep = p;
return NULL;
}
/* chip off a piece of a pending line */
p = w->pending;
p += strspn(p, " \t");
endp = p + strcspn(p, " \t");
len = endp - p;
if (*endp != '\0') {
*endp++ = '\0';
endp += strspn(endp, " \t");
}
/* endp now points to next real character, or to line-end NUL */
*linep = malloc(len + 1);
if (*linep == NULL) {
if (w->line != w->buf)
free(w->line);
return "out of memory for new argument";
}
strcpy(*linep, p);
if (*endp == '\0') {
w->pending = NULL;
if (w->line != w->buf)
free(w->line);
} else
w->pending = endp;
return NULL;
}
/*
- getline - read a line from the file, trim newline off
*/
static char * /* pointer to line, NULL for eof/error */
getline(f, buf, bufsize)
FILE *f;
char *buf; /* buffer to use, if convenient */
size_t bufsize; /* size of buf */
{
size_t len;
if (fgets(buf, bufsize, f) == NULL)
return NULL;
len = strlen(buf);
if (len < bufsize-1 || buf[bufsize-1] == '\n') {
/* it fit */
buf[len-1] = '\0';
return buf;
}
/* oh crud, buffer overflow */
/* for now, to hell with it */
return NULL;
}
#ifdef TEST
#include <getopt.h>
char usage[] = "Usage: tester [--foo] [--bar] [--optionsfrom file] arg ...";
struct option opts[] = {
"foo", 0, NULL, 'f',
"bar", 0, NULL, 'b',
"builtin", 0, NULL, 'B',
"optionsfrom", 1, NULL, '+',
"help", 0, NULL, 'h',
"version", 0, NULL, 'v',
0, 0, NULL, 0,
};
int
main(argc, argv)
int argc;
char *argv[];
{
int opt;
extern char *optarg;
extern int optind;
int errflg = 0;
const char *p;
int i;
FILE *errs = NULL;
while ((opt = getopt_long(argc, argv, "", opts, NULL)) != EOF)
switch (opt) {
case 'f':
case 'b':
break;
case 'B':
errs = stderr;
break;
case '+': /* optionsfrom */
p = optionsfrom(optarg, &argc, &argv, optind, errs);
if (p != NULL) {
fprintf(stderr, "%s: optionsfrom error: %s\n",
argv[0], p);
exit(1);
}
break;
case 'h': /* help */
printf("%s\n", usage);
exit(0);
break;
case 'v': /* version */
printf("1\n");
exit(0);
break;
case '?':
default:
errflg = 1;
break;
}
if (errflg) {
fprintf(stderr, "%s\n", usage);
exit(2);
}
for (i = 1; i < argc; i++)
printf("%d: `%s'\n", i, argv[i]);
exit(0);
}
#endif /* TEST */
linux/lib/libfreeswan/pfkey_v2_build.c
+1438
View File
File diff suppressed because it is too large Load Diff
linux/lib/libfreeswan/pfkey_v2_debug.c
+179
View File
@@ -0,0 +1,179 @@
/*
* @(#) pfkey version 2 debugging messages
*
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: pfkey_v2_debug.c,v 1.2 2004/03/22 21:53:18 as Exp $
*
*/
#ifdef __KERNEL__
# include <linux/kernel.h> /* for printk */
# include "freeswan/ipsec_kversion.h" /* for malloc switch */
# ifdef MALLOC_SLAB
# include <linux/slab.h> /* kmalloc() */
# else /* MALLOC_SLAB */
# include <linux/malloc.h> /* kmalloc() */
# endif /* MALLOC_SLAB */
# include <linux/errno.h> /* error codes */
# include <linux/types.h> /* size_t */
# include <linux/interrupt.h> /* mark_bh */
# include <linux/netdevice.h> /* struct device, and other headers */
# include <linux/etherdevice.h> /* eth_type_trans */
extern int debug_pfkey;
#else /* __KERNEL__ */
# include <sys/types.h>
# include <linux/types.h>
# include <linux/errno.h>
#endif /* __KERNEL__ */
#include "freeswan.h"
#include "pfkeyv2.h"
#include "pfkey.h"
/*
* This file provides ASCII translations of PF_KEY magic numbers.
*
*/
static char *pfkey_sadb_ext_strings[]={
"reserved", /* SADB_EXT_RESERVED 0 */
"security-association", /* SADB_EXT_SA 1 */
"lifetime-current", /* SADB_EXT_LIFETIME_CURRENT 2 */
"lifetime-hard", /* SADB_EXT_LIFETIME_HARD 3 */
"lifetime-soft", /* SADB_EXT_LIFETIME_SOFT 4 */
"source-address", /* SADB_EXT_ADDRESS_SRC 5 */
"destination-address", /* SADB_EXT_ADDRESS_DST 6 */
"proxy-address", /* SADB_EXT_ADDRESS_PROXY 7 */
"authentication-key", /* SADB_EXT_KEY_AUTH 8 */
"cipher-key", /* SADB_EXT_KEY_ENCRYPT 9 */
"source-identity", /* SADB_EXT_IDENTITY_SRC 10 */
"destination-identity", /* SADB_EXT_IDENTITY_DST 11 */
"sensitivity-label", /* SADB_EXT_SENSITIVITY 12 */
"proposal", /* SADB_EXT_PROPOSAL 13 */
"supported-auth", /* SADB_EXT_SUPPORTED_AUTH 14 */
"supported-cipher", /* SADB_EXT_SUPPORTED_ENCRYPT 15 */
"spi-range", /* SADB_EXT_SPIRANGE 16 */
"X-kmpprivate", /* SADB_X_EXT_KMPRIVATE 17 */
"X-satype2", /* SADB_X_EXT_SATYPE2 18 */
"X-security-association", /* SADB_X_EXT_SA2 19 */
"X-destination-address2", /* SADB_X_EXT_ADDRESS_DST2 20 */
"X-source-flow-address", /* SADB_X_EXT_ADDRESS_SRC_FLOW 21 */
"X-dest-flow-address", /* SADB_X_EXT_ADDRESS_DST_FLOW 22 */
"X-source-mask", /* SADB_X_EXT_ADDRESS_SRC_MASK 23 */
"X-dest-mask", /* SADB_X_EXT_ADDRESS_DST_MASK 24 */
"X-set-debug", /* SADB_X_EXT_DEBUG 25 */
#ifdef NAT_TRAVERSAL
"X-NAT-T-type", /* SADB_X_EXT_NAT_T_TYPE 26 */
"X-NAT-T-sport", /* SADB_X_EXT_NAT_T_SPORT 27 */
"X-NAT-T-dport", /* SADB_X_EXT_NAT_T_DPORT 28 */
"X-NAT-T-OA", /* SADB_X_EXT_NAT_T_OA 29 */
#endif
};
const char *
pfkey_v2_sadb_ext_string(int ext)
{
if(ext <= SADB_EXT_MAX) {
return pfkey_sadb_ext_strings[ext];
} else {
return "unknown-ext";
}
}
static char *pfkey_sadb_type_strings[]={
"reserved", /* SADB_RESERVED */
"getspi", /* SADB_GETSPI */
"update", /* SADB_UPDATE */
"add", /* SADB_ADD */
"delete", /* SADB_DELETE */
"get", /* SADB_GET */
"acquire", /* SADB_ACQUIRE */
"register", /* SADB_REGISTER */
"expire", /* SADB_EXPIRE */
"flush", /* SADB_FLUSH */
"dump", /* SADB_DUMP */
"x-promisc", /* SADB_X_PROMISC */
"x-pchange", /* SADB_X_PCHANGE */
"x-groupsa", /* SADB_X_GRPSA */
"x-addflow(eroute)", /* SADB_X_ADDFLOW */
"x-delflow(eroute)", /* SADB_X_DELFLOW */
"x-debug", /* SADB_X_DEBUG */
};
const char *
pfkey_v2_sadb_type_string(int sadb_type)
{
if(sadb_type <= SADB_MAX) {
return pfkey_sadb_type_strings[sadb_type];
} else {
return "unknown-sadb-type";
}
}
/*
* $Log: pfkey_v2_debug.c,v $
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.2.1 2004/03/15 22:30:06 as
* nat-0.6c patch merged
*
* Revision 1.1 2004/03/15 20:35:26 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.7 2002/09/20 05:01:26 rgb
* Fixed limit inclusion error in both type and ext string conversion.
*
* Revision 1.6 2002/04/24 07:55:32 mcr
* #include patches and Makefiles for post-reorg compilation.
*
* Revision 1.5 2002/04/24 07:36:40 mcr
* Moved from ./lib/pfkey_v2_debug.c,v
*
* Revision 1.4 2002/01/29 22:25:36 rgb
* Re-add ipsec_kversion.h to keep MALLOC happy.
*
* Revision 1.3 2002/01/29 01:59:09 mcr
* removal of kversions.h - sources that needed it now use ipsec_param.h.
* updating of IPv6 structures to match latest in6.h version.
* removed dead code from freeswan.h that also duplicated kversions.h
* code.
*
* Revision 1.2 2002/01/20 20:34:50 mcr
* added pfkey_v2_sadb_type_string to decode sadb_type to string.
*
* Revision 1.1 2001/11/27 05:30:06 mcr
* initial set of debug strings for pfkey debugging.
* this will eventually only be included for debug builds.
*
* Revision 1.1 2001/09/21 04:12:03 mcr
* first compilable version.
*
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/

Some files were not shown because too many files have changed in this diff Show More