[Openvpn-devel] [S] Change in openvpn[master]: Add aws-lc siphash implementation
"plaisthos \(Code Review\) via Openvpn-devel" <[email protected]> Thu, 30 Jul 2026 11:41:35 +0000
| Newsgroups | net.sourceforge.lists.openvpn-devel |
|---|---|
| Message-ID | <ed053e13e70eb1916de70017baa5d5549278e468-EmailReplacePatchSet-HTML@gerrit.openvpn.net> |
--===============2179811984817406290==
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-Type: multipart/alternative; boundary="PE7Ejgf8dHQ="; charset=UTF-8
--PE7Ejgf8dHQ=
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Attention is currently required from: flichtenheld=2E
Hello flichtenheld, =
I'd like you to reexamine a change=2E Please visit
http://gerrit=2Eo=
penvpn=2Enet/c/openvpn/+/1572?usp=3Demail
to look at the new patch set (#2=
2)=2E
The following approvals got outdated and were removed:
Code-Review-1=
by flichtenheld
Change subject: Add aws-lc siphash implementation
=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E
Add aws-lc siphash =
implementation
AWS-LC has a siphash implementation that is just a simple f=
unction call
that also performs the same/better than the reference implemen=
tation that
it looks to be based on=2E AWS-lc variant seems to have come fr=
om boringssl
according to the Google copyright=2E
The return type of the s=
iphash related function has been also removed as
neither the reference nor =
the aws-lc implementation can fail=2E Only the
OpenSSL based implementation=
needed a return type=2E
Change-Id: I05e20f8c82494e4abf96fe1e3a73e1c7b9101=
af6
Signed-off-by: Arne Schwabe <arne@rfc2549=2Eorg>
---
M src/openvpn/siph=
ash=2Eh
M src/openvpn/siphash_reference=2Ec
2 files changed, 42 insertions(=
+), 7 deletions(-)
git pull ssh://gerrit=2Eopenvpn=2Enet:29418/openvpn =
refs/changes/72/1572/22
diff --git a/src/openvpn/siphash=2Eh b/src/openvpn=
/siphash=2Eh
index bddddc3=2E=2E3c0f560 100644
--- a/src/openvpn/siphash=2E=
h
+++ b/src/openvpn/siphash=2Eh
@@ -18,26 +18,63 @@
#ifndef SIPHASH_H
#de=
fine SIPHASH_H
+#ifdef HAVE_CONFIG_H
+#include "config=2Eh"
+#endif
+
#i=
nclude <stdint=2Eh>
#include <stdio=2Eh>
#include <stdbool=2Eh>
+/* We =
need to include this to check for the OPENSSL_IS_AWSLC macro */
+#ifdef ENA=
BLE_CRYPTO_OPENSSL
+#include <openssl/opensslv=2Eh>
+#endif
+
/* siphash a=
lways uses 128-bit keys */
#define SIPHASH_KEY_SIZE 16
/**
* Calculat=
es SIPHASH using the reference implementation
*/
-int
+void
siphash_refe=
rence(const void *in, size_t inlen, const void *k,
uint8=
_t *out, size_t outlen);
-static inline int
+#if defined(OPENSSL_IS_AWS=
LC)
+#define USE_CRYPOTOLIB_SIPHASH
+#include <openssl/siphash=2Eh>
+#inclu=
de <string=2Eh>
+#include "error=2Eh"
+/**
+ * Computes a SipHash value
+ =
* @param in pointer to input data (read-only)
+ * @param inlen i=
nput data length in bytes (any size_t value)
+ * @param k pointer t=
o the key data (read-only), must be 16 bytes
+ * @param out pointer t=
o output data (write-only), outlen bytes must be allocated
+ * @param out=
len length of the output in bytes, must be 8
+ */
+static inline void
+sip=
hash_cryptolib(const void *in, const size_t inlen,
+ const=
void *k, uint8_t *out, const size_t outlen)
+{
+ ASSERT(outlen =3D=3D s=
izeof(uint64_t));
+ uint64_t sipout =3D SIPHASH_24(k, in, inlen);
+
+ =
memcpy(out, &sipout, sizeof(uint64_t));
+}
+#endif
+
+static inline void
=
siphash(const void *in, size_t inlen, const void *k,
uint8_t *out,=
size_t outlen)
{
+#if defined(USE_CRYPOTOLIB_SIPHASH)
+ return siphash=
_cryptolib(in, inlen, k, out, outlen);
+#else
return siphash_reference=
(in, inlen, k, out, outlen);
+#endif
}
-#endif /* ifndef SIPHASH_H */
\ =
No newline at end of file
+#endif /* ifndef SIPHASH_H */
diff --git a/src/o=
penvpn/siphash_reference=2Ec b/src/openvpn/siphash_reference=2Ec
index ad19=
a51=2E=2E5f0adb9 100644
--- a/src/openvpn/siphash_reference=2Ec
+++ b/src/o=
penvpn/siphash_reference=2Ec
@@ -99,7 +99,7 @@
* out: pointer to output d=
ata (write-only), outlen bytes must be allocated
* outlen: length of the=
output in bytes, must be 8 or 16
*/
-int
+void
siphash_reference(const =
void *in, const size_t inlen, const void *k, uint8_t *out,
=
const size_t outlen)
{
@@ -206,7 +206,7 @@
if (outlen =3D=3D 8)
=
{
- return 0;
+ return;
}
v1 ^=3D 0xdd;
@@ -=
219,6 +219,4 @@
b =3D v0 ^ v1 ^ v2 ^ v3;
U64TO8_LE(out + 8, b);=
-
- return 0;
}
--
To view, visit http://gerrit=2Eopenvpn=2Enet/c/op=
envpn/+/1572?usp=3Demail
To unsubscribe, or for help writing mail filters, =
visit http://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail
Gerrit-MessageTyp=
e: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-=
Id: I05e20f8c82494e4abf96fe1e3a73e1c7b9101af6
Gerrit-Change-Number: 1572
Ge=
rrit-PatchSet: 22
Gerrit-Owner: plaisthos <arne-openvpn@rfc2549=2Eorg>
Gerr=
it-Reviewer: flichtenheld <frank@lichtenheld=2Ecom>
Gerrit-CC: openvpn-deve=
l <openvpn-devel@lists=2Esourceforge=2Enet>
Gerrit-Attention: flichtenheld =
<frank@lichtenheld=2Ecom>
--PE7Ejgf8dHQ=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html><html><head><style></style></head><body><p> Attention is cur=
rently required from: flichtenheld=2E </p>
<p>plaisthos <strong>uploaded pa=
tch set #22</strong> to this change=2E</p><p><a href=3D"http://gerrit=2Eope=
nvpn=2Enet/c/openvpn/+/1572?usp=3Demail">View Change</a></p><p>The followin=
g approvals got outdated and were removed:
Code-Review-1 by flichtenheld</p=
><pre class=3D"blocks" style=3D"font-family: monospace,monospace; white-spa=
ce: pre-wrap;">Add aws-lc siphash implementation<br><br>AWS-LC has a siphas=
h implementation that is just a simple function call<br>that also performs =
the same/better than the reference implementation that<br>it looks to be ba=
sed on=2E AWS-lc variant seems to have come from boringssl<br>according to =
the Google copyright=2E<br><br>The return type of the siphash related funct=
ion has been also removed as<br>neither the reference nor the aws-lc implem=
entation can fail=2E Only the<br>OpenSSL based implementation needed a retu=
rn type=2E<br><br>Change-Id: I05e20f8c82494e4abf96fe1e3a73e1c7b9101af6<br>S=
igned-off-by: Arne Schwabe <arne@rfc2549=2Eorg><br>---<br>M src/openv=
pn/siphash=2Eh<br>M src/openvpn/siphash_reference=2Ec<br>2 files changed, 4=
2 insertions(+), 7 deletions(-)<br><br></pre><pre class=3D"blocks" style=3D=
"font-family: monospace,monospace; white-space: pre-wrap;">git pull ssh://g=
errit=2Eopenvpn=2Enet:29418/openvpn refs/changes/72/1572/22</pre><pre style=
=3D"font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --=
git a/src/openvpn/siphash=2Eh b/src/openvpn/siphash=2Eh</span><br><span>ind=
ex bddddc3=2E=2E3c0f560 100644</span><br><span>--- a/src/openvpn/siphash=2E=
h</span><br><span>+++ b/src/openvpn/siphash=2Eh</span><br><span>@@ -18,26 +=
18,63 @@</span><br><span> #ifndef SIPHASH_H</span><br><span> #define SIPHAS=
H_H</span><br><span> </span><br><span style=3D"color: hsl(120, 100%, 40%);"=
>+#ifdef HAVE_CONFIG_H</span><br><span style=3D"color: hsl(120, 100%, 40%);=
">+#include "config=2Eh"</span><br><span style=3D"color: hsl(120,=
100%, 40%);">+#endif</span><br><span style=3D"color: hsl(120, 100%, 40%);"=
>+</span><br><span> #include <stdint=2Eh></span><br><span> #include &=
lt;stdio=2Eh></span><br><span> #include <stdbool=2Eh></span><br><s=
pan> </span><br><span style=3D"color: hsl(120, 100%, 40%);">+/* We need to =
include this to check for the OPENSSL_IS_AWSLC macro */</span><br><span sty=
le=3D"color: hsl(120, 100%, 40%);">+#ifdef ENABLE_CRYPTO_OPENSSL</span><br>=
<span style=3D"color: hsl(120, 100%, 40%);">+#include <openssl/opensslv=
=2Eh></span><br><span style=3D"color: hsl(120, 100%, 40%);">+#endif</spa=
n><br><span style=3D"color: hsl(120, 100%, 40%);">+</span><br><span> /* sip=
hash always uses 128-bit keys */</span><br><span> #define SIPHASH_KEY_SIZE =
16</span><br><span> </span><br><span> /**</span><br><span> * Calculates SI=
PHASH using the reference implementation</span><br><span> */</span><br><sp=
an style=3D"color: hsl(0, 100%, 40%);">-int</span><br><span style=3D"color:=
hsl(120, 100%, 40%);">+void</span><br><span> siphash_reference(const void =
*in, size_t inlen, const void *k,</span><br><span> uint8_=
t *out, size_t outlen);</span><br><span> </span><br><span> </span><br><span=
style=3D"color: hsl(0, 100%, 40%);">-static inline int</span><br><span sty=
le=3D"color: hsl(120, 100%, 40%);">+#if defined(OPENSSL_IS_AWSLC)</span><br=
><span style=3D"color: hsl(120, 100%, 40%);">+#define USE_CRYPOTOLIB_SIPHAS=
H</span><br><span style=3D"color: hsl(120, 100%, 40%);">+#include <opens=
sl/siphash=2Eh></span><br><span style=3D"color: hsl(120, 100%, 40%);">+#=
include <string=2Eh></span><br><span style=3D"color: hsl(120, 100%, 4=
0%);">+#include "error=2Eh"</span><br><span style=3D"color: hsl(1=
20, 100%, 40%);">+/**</span><br><span style=3D"color: hsl(120, 100%, 40%);"=
>+ * Computes a SipHash value</span><br><span style=3D"color: hsl(120, 100=
%, 40%);">+ * @param in pointer to input data (read-only)</span><br>=
<span style=3D"color: hsl(120, 100%, 40%);">+ * @param inlen input data=
length in bytes (any size_t value)</span><br><span style=3D"color: hsl(120=
, 100%, 40%);">+ * @param k pointer to the key data (read-only), mu=
st be 16 bytes</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ * @p=
aram out pointer to output data (write-only), outlen bytes must be al=
located</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ * @param =
outlen length of the output in bytes, must be 8</span><br><span style=3D"c=
olor: hsl(120, 100%, 40%);">+ */</span><br><span style=3D"color: hsl(120, 1=
00%, 40%);">+static inline void</span><br><span style=3D"color: hsl(120, 10=
0%, 40%);">+siphash_cryptolib(const void *in, const size_t inlen,</span><br=
><span style=3D"color: hsl(120, 100%, 40%);">+ const void =
*k, uint8_t *out, const size_t outlen)</span><br><span style=3D"color: hsl(=
120, 100%, 40%);">+{</span><br><span style=3D"color: hsl(120, 100%, 40%);">=
+ ASSERT(outlen =3D=3D sizeof(uint64_t));</span><br><span style=3D"color=
: hsl(120, 100%, 40%);">+ uint64_t sipout =3D SIPHASH_24(k, in, inlen);<=
/span><br><span style=3D"color: hsl(120, 100%, 40%);">+</span><br><span sty=
le=3D"color: hsl(120, 100%, 40%);">+ memcpy(out, &sipout, sizeof(uin=
t64_t));</span><br><span style=3D"color: hsl(120, 100%, 40%);">+}</span><br=
><span style=3D"color: hsl(120, 100%, 40%);">+#endif</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+</span><br><span style=3D"color: hsl(120,=
100%, 40%);">+static inline void</span><br><span> siphash(const void *in, =
size_t inlen, const void *k,</span><br><span> uint8_t *out, size_t =
outlen)</span><br><span> {</span><br><span style=3D"color: hsl(120, 100%, 4=
0%);">+#if defined(USE_CRYPOTOLIB_SIPHASH)</span><br><span style=3D"color: =
hsl(120, 100%, 40%);">+ return siphash_cryptolib(in, inlen, k, out, outl=
en);</span><br><span style=3D"color: hsl(120, 100%, 40%);">+#else</span><br=
><span> return siphash_reference(in, inlen, k, out, outlen);</span><br>=
<span style=3D"color: hsl(120, 100%, 40%);">+#endif</span><br><span> }</spa=
n><br><span> </span><br><span style=3D"color: hsl(0, 100%, 40%);">-#endif /=
* ifndef SIPHASH_H */</span><br><span>\ No newline at end of file</span><br=
><span style=3D"color: hsl(120, 100%, 40%);">+#endif /* ifndef SIPHASH_H */=
</span><br><span>diff --git a/src/openvpn/siphash_reference=2Ec b/src/openv=
pn/siphash_reference=2Ec</span><br><span>index ad19a51=2E=2E5f0adb9 100644<=
/span><br><span>--- a/src/openvpn/siphash_reference=2Ec</span><br><span>+++=
b/src/openvpn/siphash_reference=2Ec</span><br><span>@@ -99,7 +99,7 @@</spa=
n><br><span> * out: pointer to output data (write-only), outlen bytes must=
be allocated</span><br><span> * outlen: length of the output in bytes, m=
ust be 8 or 16</span><br><span> */</span><br><span style=3D"color: hsl(0, =
100%, 40%);">-int</span><br><span style=3D"color: hsl(120, 100%, 40%);">+vo=
id</span><br><span> siphash_reference(const void *in, const size_t inlen, c=
onst void *k, uint8_t *out,</span><br><span> const size_t=
outlen)</span><br><span> {</span><br><span>@@ -206,7 +206,7 @@</span><br><=
span> </span><br><span> if (outlen =3D=3D 8)</span><br><span> {</sp=
an><br><span style=3D"color: hsl(0, 100%, 40%);">- return 0;</span><=
br><span style=3D"color: hsl(120, 100%, 40%);">+ return;</span><br><=
span> }</span><br><span> </span><br><span> v1 ^=3D 0xdd;</span><br>=
<span>@@ -219,6 +219,4 @@</span><br><span> </span><br><span> b =3D v0 ^=
v1 ^ v2 ^ v3;</span><br><span> U64TO8_LE(out + 8, b);</span><br><span =
style=3D"color: hsl(0, 100%, 40%);">-</span><br><span style=3D"color: hsl(0=
, 100%, 40%);">- return 0;</span><br><span> }</span><br><span></span><br=
></pre><p>To view, visit <a href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn=
/+/1572?usp=3Demail">change 1572</a>=2E To unsubscribe, or for help writing=
mail filters, visit <a href=3D"http://gerrit=2Eopenvpn=2Enet/settings?usp=
=3Demail">settings</a>=2E</p><div itemscope itemtype=3D"http://schema=2Eorg=
/EmailMessage"><div itemscope itemprop=3D"action" itemtype=3D"http://schema=
=2Eorg/ViewAction"><link itemprop=3D"url" href=3D"http://gerrit=2Eopenvpn=
=2Enet/c/openvpn/+/1572?usp=3Demail"/><meta itemprop=3D"name" content=3D"Vi=
ew Change"/></div></div>
<div style=3D"display:none"> Gerrit-MessageType: =
newpatchset </div>
<div style=3D"display:none"> Gerrit-Project: openvpn </d=
iv>
<div style=3D"display:none"> Gerrit-Branch: master </div>
<div style=3D=
"display:none"> Gerrit-Change-Id: I05e20f8c82494e4abf96fe1e3a73e1c7b9101af6=
</div>
<div style=3D"display:none"> Gerrit-Change-Number: 1572 </div>
<div=
style=3D"display:none"> Gerrit-PatchSet: 22 </div>
<div style=3D"display:n=
one"> Gerrit-Owner: plaisthos <arne-openvpn@rfc2549=2Eorg> </div>
<di=
v style=3D"display:none"> Gerrit-Reviewer: flichtenheld <frank@lichtenhe=
ld=2Ecom> </div>
<div style=3D"display:none"> Gerrit-CC: openvpn-devel &=
lt;openvpn-devel@lists=2Esourceforge=2Enet> </div>
<div style=3D"display=
:none"> Gerrit-Attention: flichtenheld <frank@lichtenheld=2Ecom> </di=
v>
</body></html>
--PE7Ejgf8dHQ=--
--===============2179811984817406290==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============2179811984817406290==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
--===============2179811984817406290==--