Skip to content

[PWCI] "crypto/openssl: Add support for SHA3 algorithms" #596

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ovsrobot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[PWCI] "crypto/openssl: Add support for SHA3 algorithms" #596

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions drivers/crypto/openssl/rte_openssl_pmd.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,14 @@ digest_name_get(enum rte_crypto_auth_algorithm algo)
return OSSL_DIGEST_NAME_SHA2_384;
case RTE_CRYPTO_AUTH_SHA512_HMAC:
return OSSL_DIGEST_NAME_SHA2_512;
case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
return OSSL_DIGEST_NAME_SHA3_224;
case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
return OSSL_DIGEST_NAME_SHA3_256;
case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
return OSSL_DIGEST_NAME_SHA3_384;
case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
return OSSL_DIGEST_NAME_SHA3_512;
default:
return NULL;
}
Expand Down Expand Up @@ -270,6 +278,22 @@ get_auth_algo(enum rte_crypto_auth_algorithm sessalgo,
case RTE_CRYPTO_AUTH_SHA512_HMAC:
*algo = EVP_sha512();
break;
case RTE_CRYPTO_AUTH_SHA3_224:
case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
*algo = EVP_sha3_224();
break;
case RTE_CRYPTO_AUTH_SHA3_256:
case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
*algo = EVP_sha3_256();
break;
case RTE_CRYPTO_AUTH_SHA3_384:
case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
*algo = EVP_sha3_384();
break;
case RTE_CRYPTO_AUTH_SHA3_512:
case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
*algo = EVP_sha3_512();
break;
Comment on lines +281 to +296
Copy link

@coderabbitai coderabbitai bot Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Missing version guard for SHA3 functions will cause compilation errors.

EVP_sha3_224/256/384/512 functions were introduced in OpenSSL 1.1.1, but these cases are not version-guarded. Since the codebase supports OpenSSL 1.0.x (see guards at line 26), this will cause compilation failures on older OpenSSL versions.

Suggested fix 
 		*algo = EVP_sha512();
 		break;
+#if (OPENSSL_VERSION_NUMBER >= 0x1010100fL)
 	case RTE_CRYPTO_AUTH_SHA3_224:
 	case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
 		*algo = EVP_sha3_224();
 		break;
 	case RTE_CRYPTO_AUTH_SHA3_256:
 	case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
 		*algo = EVP_sha3_256();
 		break;
 	case RTE_CRYPTO_AUTH_SHA3_384:
 	case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
 		*algo = EVP_sha3_384();
 		break;
 	case RTE_CRYPTO_AUTH_SHA3_512:
 	case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
 		*algo = EVP_sha3_512();
 		break;
+#endif
 	default:
 		res = -EINVAL;
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
case RTE_CRYPTO_AUTH_SHA3_224:
case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
*algo = EVP_sha3_224();
break;
case RTE_CRYPTO_AUTH_SHA3_256:
case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
*algo = EVP_sha3_256();
break;
case RTE_CRYPTO_AUTH_SHA3_384:
case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
*algo = EVP_sha3_384();
break;
case RTE_CRYPTO_AUTH_SHA3_512:
case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
*algo = EVP_sha3_512();
break;
*algo = EVP_sha512();
break;
#if (OPENSSL_VERSION_NUMBER >= 0x1010100fL)
case RTE_CRYPTO_AUTH_SHA3_224:
case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
*algo = EVP_sha3_224();
break;
case RTE_CRYPTO_AUTH_SHA3_256:
case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
*algo = EVP_sha3_256();
break;
case RTE_CRYPTO_AUTH_SHA3_384:
case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
*algo = EVP_sha3_384();
break;
case RTE_CRYPTO_AUTH_SHA3_512:
case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
*algo = EVP_sha3_512();
break;
#endif
default:
res = -EINVAL;

default:
res = -EINVAL;
break;
Expand Down Expand Up @@ -659,6 +683,10 @@ openssl_set_session_auth_parameters(struct openssl_session *sess,
case RTE_CRYPTO_AUTH_SHA256:
case RTE_CRYPTO_AUTH_SHA384:
case RTE_CRYPTO_AUTH_SHA512:
case RTE_CRYPTO_AUTH_SHA3_224:
case RTE_CRYPTO_AUTH_SHA3_256:
case RTE_CRYPTO_AUTH_SHA3_384:
case RTE_CRYPTO_AUTH_SHA3_512:
Comment on lines +686 to +689
Copy link

@coderabbitai coderabbitai bot Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Plain SHA3 authentication requires OpenSSL 1.1.1+ version guard.

These SHA3 auth cases call get_auth_algo which uses EVP_sha3_* functions only available in OpenSSL 1.1.1+. Add version guards to prevent compilation errors on older versions.

Suggested fix 
 	case RTE_CRYPTO_AUTH_SHA384:
 	case RTE_CRYPTO_AUTH_SHA512:
+#if (OPENSSL_VERSION_NUMBER >= 0x1010100fL)
 	case RTE_CRYPTO_AUTH_SHA3_224:
 	case RTE_CRYPTO_AUTH_SHA3_256:
 	case RTE_CRYPTO_AUTH_SHA3_384:
 	case RTE_CRYPTO_AUTH_SHA3_512:
+#endif
 		sess->auth.mode = OPENSSL_AUTH_AS_AUTH;
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
case RTE_CRYPTO_AUTH_SHA3_224:
case RTE_CRYPTO_AUTH_SHA3_256:
case RTE_CRYPTO_AUTH_SHA3_384:
case RTE_CRYPTO_AUTH_SHA3_512:
case RTE_CRYPTO_AUTH_SHA384:
case RTE_CRYPTO_AUTH_SHA512:
#if (OPENSSL_VERSION_NUMBER >= 0x1010100fL)
case RTE_CRYPTO_AUTH_SHA3_224:
case RTE_CRYPTO_AUTH_SHA3_256:
case RTE_CRYPTO_AUTH_SHA3_384:
case RTE_CRYPTO_AUTH_SHA3_512:
#endif
sess->auth.mode = OPENSSL_AUTH_AS_AUTH;
🤖 Prompt for AI Agents 
In @drivers/crypto/openssl/rte_openssl_pmd.c around lines 686 - 689, The SHA3
auth case labels (RTE_CRYPTO_AUTH_SHA3_224, RTE_CRYPTO_AUTH_SHA3_256,
RTE_CRYPTO_AUTH_SHA3_384, RTE_CRYPTO_AUTH_SHA3_512) must be guarded by an
OpenSSL version check because get_auth_algo calls EVP_sha3_* which only exists
in OpenSSL 1.1.1+; wrap those case labels and any associated handling in an #if
OPENSSL_VERSION_NUMBER >= 0x10101000L / #endif block (include/open with
opensslv.h if not already) so builds against older OpenSSL skip these cases and
avoid compilation errors.

sess->auth.mode = OPENSSL_AUTH_AS_AUTH;
if (get_auth_algo(xform->auth.algo,
&sess->auth.auth.evp_algo) != 0)
Expand Down Expand Up @@ -714,6 +742,10 @@ openssl_set_session_auth_parameters(struct openssl_session *sess,
case RTE_CRYPTO_AUTH_SHA256_HMAC:
case RTE_CRYPTO_AUTH_SHA384_HMAC:
case RTE_CRYPTO_AUTH_SHA512_HMAC:
case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
sess->auth.mode = OPENSSL_AUTH_AS_HMAC;

algo = digest_name_get(xform->auth.algo);
Expand Down Expand Up @@ -744,6 +776,10 @@ openssl_set_session_auth_parameters(struct openssl_session *sess,
case RTE_CRYPTO_AUTH_SHA256_HMAC:
case RTE_CRYPTO_AUTH_SHA384_HMAC:
case RTE_CRYPTO_AUTH_SHA512_HMAC:
case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
Comment on lines +779 to +782
Copy link

@coderabbitai coderabbitai bot Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

SHA3 HMAC in legacy branch requires version guard for OpenSSL 1.1.1+.

This else branch handles OpenSSL < 3.0, but SHA3 support still requires OpenSSL 1.1.1+. The code will fail to compile on OpenSSL 1.0.x and 1.1.0.

Suggested fix 
 	case RTE_CRYPTO_AUTH_SHA256_HMAC:
 	case RTE_CRYPTO_AUTH_SHA384_HMAC:
 	case RTE_CRYPTO_AUTH_SHA512_HMAC:
+#if (OPENSSL_VERSION_NUMBER >= 0x1010100fL)
 	case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
 	case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
 	case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
 	case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
+#endif
 		sess->auth.mode = OPENSSL_AUTH_AS_HMAC;
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
case RTE_CRYPTO_AUTH_SHA256_HMAC:
case RTE_CRYPTO_AUTH_SHA384_HMAC:
case RTE_CRYPTO_AUTH_SHA512_HMAC:
#if (OPENSSL_VERSION_NUMBER >= 0x1010100fL)
case RTE_CRYPTO_AUTH_SHA3_224_HMAC:
case RTE_CRYPTO_AUTH_SHA3_256_HMAC:
case RTE_CRYPTO_AUTH_SHA3_384_HMAC:
case RTE_CRYPTO_AUTH_SHA3_512_HMAC:
#endif
sess->auth.mode = OPENSSL_AUTH_AS_HMAC;
🤖 Prompt for AI Agents 
In @drivers/crypto/openssl/rte_openssl_pmd.c around lines 779 - 782, The switch
branch adding SHA3 HMAC cases (RTE_CRYPTO_AUTH_SHA3_224_HMAC,
RTE_CRYPTO_AUTH_SHA3_256_HMAC, RTE_CRYPTO_AUTH_SHA3_384_HMAC,
RTE_CRYPTO_AUTH_SHA3_512_HMAC) is inside the legacy OpenSSL < 3.0 path but lacks
a guard for OpenSSL 1.1.1+, so compilation fails on OpenSSL 1.0.x / 1.1.0; wrap
those case labels and their handling with a preprocessor check using
OPENSSL_VERSION_NUMBER >= 0x10101000L (and close the guard) so the SHA3 HMAC
code is only compiled when OpenSSL is at least 1.1.1 in the legacy branch.

sess->auth.mode = OPENSSL_AUTH_AS_HMAC;
sess->auth.hmac.ctx = HMAC_CTX_new();
if (get_auth_algo(xform->auth.algo,
Expand Down
168 changes: 168 additions & 0 deletions drivers/crypto/openssl/rte_openssl_pmd_ops.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -269,6 +269,174 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
}, }
}, }
},
{ /* SHA3_224 HMAC */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
{.auth = {
.algo = RTE_CRYPTO_AUTH_SHA3_224_HMAC,
.block_size = 144,
.key_size = {
.min = 1,
.max = 144,
.increment = 1
},
.digest_size = {
.min = 1,
.max = 28,
.increment = 1
},
.iv_size = { 0 }
}, }
}, }
},
{ /* SHA3_224 */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
{.auth = {
.algo = RTE_CRYPTO_AUTH_SHA3_224,
.block_size = 144,
.key_size = {
.min = 0,
.max = 0,
.increment = 0
},
.digest_size = {
.min = 28,
.max = 28,
.increment = 0
},
.iv_size = { 0 }
}, }
}, }
},
{ /* SHA3_256 HMAC */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
{.auth = {
.algo = RTE_CRYPTO_AUTH_SHA3_256_HMAC,
.block_size = 136,
.key_size = {
.min = 1,
.max = 136,
.increment = 1
},
.digest_size = {
.min = 1,
.max = 32,
.increment = 1
},
.iv_size = { 0 }
}, }
}, }
},
{ /* SHA3_256 */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
{.auth = {
.algo = RTE_CRYPTO_AUTH_SHA3_256,
.block_size = 136,
.key_size = {
.min = 0,
.max = 0,
.increment = 0
},
.digest_size = {
.min = 32,
.max = 32,
.increment = 0
},
.iv_size = { 0 }
}, }
}, }
},
{ /* SHA3_384 HMAC */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
{.auth = {
.algo = RTE_CRYPTO_AUTH_SHA3_384_HMAC,
.block_size = 104,
.key_size = {
.min = 1,
.max = 104,
.increment = 1
},
.digest_size = {
.min = 1,
.max = 48,
.increment = 1
},
.iv_size = { 0 }
}, }
}, }
},
{ /* SHA3_384 */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
{.auth = {
.algo = RTE_CRYPTO_AUTH_SHA3_384,
.block_size = 104,
.key_size = {
.min = 0,
.max = 0,
.increment = 0
},
.digest_size = {
.min = 48,
.max = 48,
.increment = 0
},
.iv_size = { 0 }
}, }
}, }
},
{ /* SHA3_512 HMAC */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
{.auth = {
.algo = RTE_CRYPTO_AUTH_SHA3_512_HMAC,
.block_size = 72,
.key_size = {
.min = 1,
.max = 72,
.increment = 1
},
.digest_size = {
.min = 1,
.max = 64,
.increment = 1
},
.iv_size = { 0 }
}, }
}, }
},
{ /* SHA3_512 */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
{.auth = {
.algo = RTE_CRYPTO_AUTH_SHA3_512,
.block_size = 72,
.key_size = {
.min = 0,
.max = 0,
.increment = 0
},
.digest_size = {
.min = 64,
.max = 64,
.increment = 0
},
.iv_size = { 0 }
}, }
}, }
},
{ /* AES CBC */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
Expand Down