[PWCI] "crypto/openssl: Add support for SHA3 algorithms"#596
[PWCI] "crypto/openssl: Add support for SHA3 algorithms"#596
Conversation
openssl 3.X supports SHA3. Hence adding SHA3-224, SHA3-256, SHA3-384 and SHA3-512 support to the PMD. Signed-off-by: Emma Finn <emma.finn@intel.com> Signed-off-by: 0-day Robot <robot@bytheb.org>
Reviewer's GuideAdds SHA3-{224,256,384,512} and corresponding HMAC algorithm support to the OpenSSL crypto PMD, wiring them into the capability table, digest name mapping, OpenSSL EVP selection, and session authentication parameter handling. Sequence diagram for SHA3 HMAC session setup in OpenSSL PMDsequenceDiagram
actor App
participant CryptoDev as rte_cryptodev
participant OpensslPmd as openssl_pmd
participant OpenSSL as openssl_evp
App->>CryptoDev: rte_cryptodev_configure()
App->>CryptoDev: rte_cryptodev_sym_session_create()
App->>CryptoDev: rte_cryptodev_sym_session_init(xform: RTE_CRYPTO_AUTH_SHA3_256_HMAC)
CryptoDev->>OpensslPmd: openssl_set_session_auth_parameters(sess, xform)
activate OpensslPmd
OpensslPmd->>OpensslPmd: switch xform->auth.algo
Note right of OpensslPmd: Case RTE_CRYPTO_AUTH_SHA3_256_HMAC
OpensslPmd->>OpensslPmd: sess->auth.mode = OPENSSL_AUTH_AS_HMAC
OpensslPmd->>OpensslPmd: algo = digest_name_get(RTE_CRYPTO_AUTH_SHA3_256_HMAC)
OpensslPmd-->>OpensslPmd: algo = OSSL_DIGEST_NAME_SHA3_256
OpensslPmd->>OpenSSL: get_auth_algo(RTE_CRYPTO_AUTH_SHA3_256_HMAC, evp_algo)
activate OpenSSL
OpenSSL->>OpenSSL: switch sessalgo
OpenSSL-->>OpensslPmd: evp_algo = EVP_sha3_256()
deactivate OpenSSL
OpensslPmd-->>CryptoDev: session configured with SHA3_256_HMAC
deactivate OpensslPmd
App->>CryptoDev: rte_cryptodev_enqueue_burst(crypto_ops)
CryptoDev->>OpensslPmd: process crypto_ops with sess->auth.evp_algo (EVP_sha3_256)
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
📝 WalkthroughWalkthroughThe changes extend the OpenSSL PMD crypto driver to support SHA-3 family algorithms (SHA3-224, SHA3-256, SHA3-384, SHA3-512) in both plain and HMAC modes. Updates include digest name mappings, algorithm validation, session parameter handling, and capability declarations. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI Agents
In @drivers/crypto/openssl/rte_openssl_pmd.c:
- Around line 686-689: The SHA3 auth case labels (RTE_CRYPTO_AUTH_SHA3_224,
RTE_CRYPTO_AUTH_SHA3_256, RTE_CRYPTO_AUTH_SHA3_384, RTE_CRYPTO_AUTH_SHA3_512)
must be guarded by an OpenSSL version check because get_auth_algo calls
EVP_sha3_* which only exists in OpenSSL 1.1.1+; wrap those case labels and any
associated handling in an #if OPENSSL_VERSION_NUMBER >= 0x10101000L / #endif
block (include/open with opensslv.h if not already) so builds against older
OpenSSL skip these cases and avoid compilation errors.
- Around line 779-782: The switch branch adding SHA3 HMAC cases
(RTE_CRYPTO_AUTH_SHA3_224_HMAC, RTE_CRYPTO_AUTH_SHA3_256_HMAC,
RTE_CRYPTO_AUTH_SHA3_384_HMAC, RTE_CRYPTO_AUTH_SHA3_512_HMAC) is inside the
legacy OpenSSL < 3.0 path but lacks a guard for OpenSSL 1.1.1+, so compilation
fails on OpenSSL 1.0.x / 1.1.0; wrap those case labels and their handling with a
preprocessor check using OPENSSL_VERSION_NUMBER >= 0x10101000L (and close the
guard) so the SHA3 HMAC code is only compiled when OpenSSL is at least 1.1.1 in
the legacy branch.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
drivers/crypto/openssl/rte_openssl_pmd.cdrivers/crypto/openssl/rte_openssl_pmd_ops.c
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Sourcery review
🔇 Additional comments (2)
drivers/crypto/openssl/rte_openssl_pmd.c (1)
95-102: LGTM - SHA3 HMAC digest name mappings are correctly guarded.The SHA3 HMAC digest name mappings are properly placed within the OpenSSL 3.0+ version guard and correctly map to OSSL_DIGEST_NAME_SHA3_* constants.
drivers/crypto/openssl/rte_openssl_pmd_ops.c (1)
272-439: Consider conditionally including SHA3 capability entries based on OpenSSL version.The SHA3 capability definitions are correct (block sizes, digest sizes, key sizes all match SHA3 specifications). However, these capabilities are advertised unconditionally even when compiled against OpenSSL versions < 1.1.1 that don't support SHA3. While EVP_sha3_* functions are called at runtime in rte_openssl_pmd.c without version guards, the capabilities array itself could be wrapped with conditional compilation to prevent advertising unsupported algorithms.
| case RTE_CRYPTO_AUTH_SHA3_224: | ||
| case RTE_CRYPTO_AUTH_SHA3_224_HMAC: | ||
| *algo = EVP_sha3_224(); | ||
| break; | ||
| case RTE_CRYPTO_AUTH_SHA3_256: | ||
| case RTE_CRYPTO_AUTH_SHA3_256_HMAC: | ||
| *algo = EVP_sha3_256(); | ||
| break; | ||
| case RTE_CRYPTO_AUTH_SHA3_384: | ||
| case RTE_CRYPTO_AUTH_SHA3_384_HMAC: | ||
| *algo = EVP_sha3_384(); | ||
| break; | ||
| case RTE_CRYPTO_AUTH_SHA3_512: | ||
| case RTE_CRYPTO_AUTH_SHA3_512_HMAC: | ||
| *algo = EVP_sha3_512(); | ||
| break; |
There was a problem hiding this comment.
Missing version guard for SHA3 functions will cause compilation errors.
EVP_sha3_224/256/384/512 functions were introduced in OpenSSL 1.1.1, but these cases are not version-guarded. Since the codebase supports OpenSSL 1.0.x (see guards at line 26), this will cause compilation failures on older OpenSSL versions.
Suggested fix
*algo = EVP_sha512();
break;
+#if (OPENSSL_VERSION_NUMBER >= 0x1010100fL)
case RTE_CRYPTO_AUTH_SHA3_224:
case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
*algo = EVP_sha3_224();
break;
case RTE_CRYPTO_AUTH_SHA3_256:
case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
*algo = EVP_sha3_256();
break;
case RTE_CRYPTO_AUTH_SHA3_384:
case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
*algo = EVP_sha3_384();
break;
case RTE_CRYPTO_AUTH_SHA3_512:
case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
*algo = EVP_sha3_512();
break;
+#endif
default:
res = -EINVAL;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| case RTE_CRYPTO_AUTH_SHA3_224: | |
| case RTE_CRYPTO_AUTH_SHA3_224_HMAC: | |
| *algo = EVP_sha3_224(); | |
| break; | |
| case RTE_CRYPTO_AUTH_SHA3_256: | |
| case RTE_CRYPTO_AUTH_SHA3_256_HMAC: | |
| *algo = EVP_sha3_256(); | |
| break; | |
| case RTE_CRYPTO_AUTH_SHA3_384: | |
| case RTE_CRYPTO_AUTH_SHA3_384_HMAC: | |
| *algo = EVP_sha3_384(); | |
| break; | |
| case RTE_CRYPTO_AUTH_SHA3_512: | |
| case RTE_CRYPTO_AUTH_SHA3_512_HMAC: | |
| *algo = EVP_sha3_512(); | |
| break; | |
| *algo = EVP_sha512(); | |
| break; | |
| #if (OPENSSL_VERSION_NUMBER >= 0x1010100fL) | |
| case RTE_CRYPTO_AUTH_SHA3_224: | |
| case RTE_CRYPTO_AUTH_SHA3_224_HMAC: | |
| *algo = EVP_sha3_224(); | |
| break; | |
| case RTE_CRYPTO_AUTH_SHA3_256: | |
| case RTE_CRYPTO_AUTH_SHA3_256_HMAC: | |
| *algo = EVP_sha3_256(); | |
| break; | |
| case RTE_CRYPTO_AUTH_SHA3_384: | |
| case RTE_CRYPTO_AUTH_SHA3_384_HMAC: | |
| *algo = EVP_sha3_384(); | |
| break; | |
| case RTE_CRYPTO_AUTH_SHA3_512: | |
| case RTE_CRYPTO_AUTH_SHA3_512_HMAC: | |
| *algo = EVP_sha3_512(); | |
| break; | |
| #endif | |
| default: | |
| res = -EINVAL; |
| case RTE_CRYPTO_AUTH_SHA3_224: | ||
| case RTE_CRYPTO_AUTH_SHA3_256: | ||
| case RTE_CRYPTO_AUTH_SHA3_384: | ||
| case RTE_CRYPTO_AUTH_SHA3_512: |
There was a problem hiding this comment.
Plain SHA3 authentication requires OpenSSL 1.1.1+ version guard.
These SHA3 auth cases call get_auth_algo which uses EVP_sha3_* functions only available in OpenSSL 1.1.1+. Add version guards to prevent compilation errors on older versions.
Suggested fix
case RTE_CRYPTO_AUTH_SHA384:
case RTE_CRYPTO_AUTH_SHA512:
+#if (OPENSSL_VERSION_NUMBER >= 0x1010100fL)
case RTE_CRYPTO_AUTH_SHA3_224:
case RTE_CRYPTO_AUTH_SHA3_256:
case RTE_CRYPTO_AUTH_SHA3_384:
case RTE_CRYPTO_AUTH_SHA3_512:
+#endif
sess->auth.mode = OPENSSL_AUTH_AS_AUTH;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| case RTE_CRYPTO_AUTH_SHA3_224: | |
| case RTE_CRYPTO_AUTH_SHA3_256: | |
| case RTE_CRYPTO_AUTH_SHA3_384: | |
| case RTE_CRYPTO_AUTH_SHA3_512: | |
| case RTE_CRYPTO_AUTH_SHA384: | |
| case RTE_CRYPTO_AUTH_SHA512: | |
| #if (OPENSSL_VERSION_NUMBER >= 0x1010100fL) | |
| case RTE_CRYPTO_AUTH_SHA3_224: | |
| case RTE_CRYPTO_AUTH_SHA3_256: | |
| case RTE_CRYPTO_AUTH_SHA3_384: | |
| case RTE_CRYPTO_AUTH_SHA3_512: | |
| #endif | |
| sess->auth.mode = OPENSSL_AUTH_AS_AUTH; |
🤖 Prompt for AI Agents
In @drivers/crypto/openssl/rte_openssl_pmd.c around lines 686 - 689, The SHA3
auth case labels (RTE_CRYPTO_AUTH_SHA3_224, RTE_CRYPTO_AUTH_SHA3_256,
RTE_CRYPTO_AUTH_SHA3_384, RTE_CRYPTO_AUTH_SHA3_512) must be guarded by an
OpenSSL version check because get_auth_algo calls EVP_sha3_* which only exists
in OpenSSL 1.1.1+; wrap those case labels and any associated handling in an #if
OPENSSL_VERSION_NUMBER >= 0x10101000L / #endif block (include/open with
opensslv.h if not already) so builds against older OpenSSL skip these cases and
avoid compilation errors.
| case RTE_CRYPTO_AUTH_SHA3_224_HMAC: | ||
| case RTE_CRYPTO_AUTH_SHA3_256_HMAC: | ||
| case RTE_CRYPTO_AUTH_SHA3_384_HMAC: | ||
| case RTE_CRYPTO_AUTH_SHA3_512_HMAC: |
There was a problem hiding this comment.
SHA3 HMAC in legacy branch requires version guard for OpenSSL 1.1.1+.
This else branch handles OpenSSL < 3.0, but SHA3 support still requires OpenSSL 1.1.1+. The code will fail to compile on OpenSSL 1.0.x and 1.1.0.
Suggested fix
case RTE_CRYPTO_AUTH_SHA256_HMAC:
case RTE_CRYPTO_AUTH_SHA384_HMAC:
case RTE_CRYPTO_AUTH_SHA512_HMAC:
+#if (OPENSSL_VERSION_NUMBER >= 0x1010100fL)
case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
+#endif
sess->auth.mode = OPENSSL_AUTH_AS_HMAC;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| case RTE_CRYPTO_AUTH_SHA3_224_HMAC: | |
| case RTE_CRYPTO_AUTH_SHA3_256_HMAC: | |
| case RTE_CRYPTO_AUTH_SHA3_384_HMAC: | |
| case RTE_CRYPTO_AUTH_SHA3_512_HMAC: | |
| case RTE_CRYPTO_AUTH_SHA256_HMAC: | |
| case RTE_CRYPTO_AUTH_SHA384_HMAC: | |
| case RTE_CRYPTO_AUTH_SHA512_HMAC: | |
| #if (OPENSSL_VERSION_NUMBER >= 0x1010100fL) | |
| case RTE_CRYPTO_AUTH_SHA3_224_HMAC: | |
| case RTE_CRYPTO_AUTH_SHA3_256_HMAC: | |
| case RTE_CRYPTO_AUTH_SHA3_384_HMAC: | |
| case RTE_CRYPTO_AUTH_SHA3_512_HMAC: | |
| #endif | |
| sess->auth.mode = OPENSSL_AUTH_AS_HMAC; |
🤖 Prompt for AI Agents
In @drivers/crypto/openssl/rte_openssl_pmd.c around lines 779 - 782, The switch
branch adding SHA3 HMAC cases (RTE_CRYPTO_AUTH_SHA3_224_HMAC,
RTE_CRYPTO_AUTH_SHA3_256_HMAC, RTE_CRYPTO_AUTH_SHA3_384_HMAC,
RTE_CRYPTO_AUTH_SHA3_512_HMAC) is inside the legacy OpenSSL < 3.0 path but lacks
a guard for OpenSSL 1.1.1+, so compilation fails on OpenSSL 1.0.x / 1.1.0; wrap
those case labels and their handling with a preprocessor check using
OPENSSL_VERSION_NUMBER >= 0x10101000L (and close the guard) so the SHA3 HMAC
code is only compiled when OpenSSL is at least 1.1.1 in the legacy branch.
2 participants
NOTE: This is an auto submission for "crypto/openssl: Add support for SHA3 algorithms".
See "http://patchwork.dpdk.org/project/dpdk/list/?series=36970" for details.
Summary by Sourcery
Add SHA3 hash and HMAC authentication support to the OpenSSL crypto PMD.
New Features:
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.