[Openvpn-devel] [M] Change in openvpn[master]: Add aws-lc siphash implementation
"plaisthos \(Code Review\) via Openvpn-devel" <[email protected]> Thu, 30 Jul 2026 12:11:18 +0000
| Newsgroups | net.sourceforge.lists.openvpn-devel |
|---|---|
| Message-ID | <00b4373ccfdd4ef728a49e2d80663959f3e80c89-EmailReplacePatchSet-HTML@gerrit.openvpn.net> |
--===============2271156238221633128==
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-Type: multipart/alternative; boundary="nN1E11M24zE="; charset=UTF-8
--nN1E11M24zE=
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Attention is currently required from: flichtenheld=2E
Hello flichtenheld, =
I'd like you to reexamine a change=2E Please visit
http://gerrit=2Eo=
penvpn=2Enet/c/openvpn/+/1572?usp=3Demail
to look at the new patch set (#2=
3)=2E
Change subject: Add aws-lc siphash implementation
=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E
Add aws-lc siphash implement=
ation
AWS-LC has a siphash implementation that is just a simple function c=
all
that also performs the same/better than the reference implementation th=
at
it looks to be based on=2E AWS-lc variant seems to have come from boring=
ssl
according to the Google copyright=2E
The return type of the siphash re=
lated function has been also removed as
neither the reference nor the aws-l=
c implementation can fail=2E Only the
OpenSSL based implementation needed a=
return type=2E
Change-Id: I05e20f8c82494e4abf96fe1e3a73e1c7b9101af6
Signe=
d-off-by: Arne Schwabe <arne@rfc2549=2Eorg>
---
M src/openvpn/siphash=2Eh
M=
src/openvpn/siphash_reference=2Ec
2 files changed, 43 insertions(+), 8 del=
etions(-)
git pull ssh://gerrit=2Eopenvpn=2Enet:29418/openvpn refs/chan=
ges/72/1572/23
diff --git a/src/openvpn/siphash=2Eh b/src/openvpn/siphash=
=2Eh
index bddddc3=2E=2Eade7762 100644
--- a/src/openvpn/siphash=2Eh
+++ b/=
src/openvpn/siphash=2Eh
@@ -18,26 +18,63 @@
#ifndef SIPHASH_H
#define SIP=
HASH_H
+#ifdef HAVE_CONFIG_H
+#include "config=2Eh"
+#endif
+
#include <=
stdint=2Eh>
#include <stdio=2Eh>
#include <stdbool=2Eh>
+/* We need to =
include this to check for the OPENSSL_IS_AWSLC macro */
+#ifdef ENABLE_CRYP=
TO_OPENSSL
+#include <openssl/opensslv=2Eh>
+#endif
+
/* siphash always us=
es 128-bit keys */
#define SIPHASH_KEY_SIZE 16
/**
* Calculates SIPHA=
SH using the reference implementation
*/
-int
+void
siphash_reference(co=
nst void *in, size_t inlen, const void *k,
uint8_t *out,=
size_t outlen);
-static inline int
+#if defined(OPENSSL_IS_AWSLC)
+#de=
fine USE_CRYPOTOLIB_SIPHASH
+#include <openssl/siphash=2Eh>
+#include <stri=
ng=2Eh>
+#include "error=2Eh"
+/**
+ * Computes a SipHash value
+ * @param=
in pointer to input data (read-only)
+ * @param inlen input dat=
a length in bytes (any size_t value)
+ * @param k pointer to the ke=
y data (read-only), must be 16 bytes
+ * @param out pointer to output=
data (write-only), outlen bytes must be allocated
+ * @param outlen len=
gth of the output in bytes, must be 8
+ */
+static inline void
+siphash_cry=
ptolib(const void *in, const size_t inlen,
+ const void *k=
, uint8_t *out, const size_t outlen)
+{
+ ASSERT(outlen =3D=3D sizeof(ui=
nt64_t));
+ uint64_t sipout =3D SIPHASH_24(k, in, inlen);
+
+ memcpy(=
out, &sipout, sizeof(uint64_t));
+}
+#endif
+
+static inline void
siphash(=
const void *in, size_t inlen, const void *k,
uint8_t *out, size_t =
outlen)
{
- return siphash_reference(in, inlen, k, out, outlen);
+#if d=
efined(USE_CRYPOTOLIB_SIPHASH)
+ siphash_cryptolib(in, inlen, k, out, ou=
tlen);
+#else
+ siphash_reference(in, inlen, k, out, outlen);
+#endif
}=
-#endif /* ifndef SIPHASH_H */
\ No newline at end of file
+#endif /* if=
ndef SIPHASH_H */
diff --git a/src/openvpn/siphash_reference=2Ec b/src/open=
vpn/siphash_reference=2Ec
index ad19a51=2E=2E5f0adb9 100644
--- a/src/openv=
pn/siphash_reference=2Ec
+++ b/src/openvpn/siphash_reference=2Ec
@@ -99,7 +=
99,7 @@
* out: pointer to output data (write-only), outlen bytes must be =
allocated
* outlen: length of the output in bytes, must be 8 or 16
*/
=
-int
+void
siphash_reference(const void *in, const size_t inlen, const voi=
d *k, uint8_t *out,
const size_t outlen)
{
@@ -206,7 +2=
06,7 @@
if (outlen =3D=3D 8)
{
- return 0;
+ retu=
rn;
}
v1 ^=3D 0xdd;
@@ -219,6 +219,4 @@
b =3D v0 ^ v1 ^ =
v2 ^ v3;
U64TO8_LE(out + 8, b);
-
- return 0;
}
--
To view, visi=
t http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1572?usp=3Demail
To unsubscribe=
, or for help writing mail filters, visit http://gerrit=2Eopenvpn=2Enet/set=
tings?usp=3Demail
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
=
Gerrit-Branch: master
Gerrit-Change-Id: I05e20f8c82494e4abf96fe1e3a73e1c7b9=
101af6
Gerrit-Change-Number: 1572
Gerrit-PatchSet: 23
Gerrit-Owner: plaisth=
os <arne-openvpn@rfc2549=2Eorg>
Gerrit-Reviewer: flichtenheld <frank@lichte=
nheld=2Ecom>
Gerrit-CC: openvpn-devel <openvpn-devel@lists=2Esourceforge=2E=
net>
Gerrit-Attention: flichtenheld <frank@lichtenheld=2Ecom>
--nN1E11M24zE=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html><html><head><style></style></head><body><p> Attention is cur=
rently required from: flichtenheld=2E </p>
<p>plaisthos <strong>uploaded pa=
tch set #23</strong> to this change=2E</p><p><a href=3D"http://gerrit=2Eope=
nvpn=2Enet/c/openvpn/+/1572?usp=3Demail">View Change</a></p><pre class=3D"b=
locks" style=3D"font-family: monospace,monospace; white-space: pre-wrap;">A=
dd aws-lc siphash implementation<br><br>AWS-LC has a siphash implementation=
that is just a simple function call<br>that also performs the same/better =
than the reference implementation that<br>it looks to be based on=2E AWS-lc=
variant seems to have come from boringssl<br>according to the Google copyr=
ight=2E<br><br>The return type of the siphash related function has been als=
o removed as<br>neither the reference nor the aws-lc implementation can fai=
l=2E Only the<br>OpenSSL based implementation needed a return type=2E<br><b=
r>Change-Id: I05e20f8c82494e4abf96fe1e3a73e1c7b9101af6<br>Signed-off-by: Ar=
ne Schwabe <arne@rfc2549=2Eorg><br>---<br>M src/openvpn/siphash=2Eh<b=
r>M src/openvpn/siphash_reference=2Ec<br>2 files changed, 43 insertions(+),=
8 deletions(-)<br><br></pre><pre class=3D"blocks" style=3D"font-family: mo=
nospace,monospace; white-space: pre-wrap;">git pull ssh://gerrit=2Eopenvpn=
=2Enet:29418/openvpn refs/changes/72/1572/23</pre><pre style=3D"font-family=
: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/src/openv=
pn/siphash=2Eh b/src/openvpn/siphash=2Eh</span><br><span>index bddddc3=2E=
=2Eade7762 100644</span><br><span>--- a/src/openvpn/siphash=2Eh</span><br><=
span>+++ b/src/openvpn/siphash=2Eh</span><br><span>@@ -18,26 +18,63 @@</spa=
n><br><span> #ifndef SIPHASH_H</span><br><span> #define SIPHASH_H</span><br=
><span> </span><br><span style=3D"color: hsl(120, 100%, 40%);">+#ifdef HAVE=
_CONFIG_H</span><br><span style=3D"color: hsl(120, 100%, 40%);">+#include &=
quot;config=2Eh"</span><br><span style=3D"color: hsl(120, 100%, 40%);"=
>+#endif</span><br><span style=3D"color: hsl(120, 100%, 40%);">+</span><br>=
<span> #include <stdint=2Eh></span><br><span> #include <stdio=2Eh&=
gt;</span><br><span> #include <stdbool=2Eh></span><br><span> </span><=
br><span style=3D"color: hsl(120, 100%, 40%);">+/* We need to include this =
to check for the OPENSSL_IS_AWSLC macro */</span><br><span style=3D"color: =
hsl(120, 100%, 40%);">+#ifdef ENABLE_CRYPTO_OPENSSL</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+#include <openssl/opensslv=2Eh></sp=
an><br><span style=3D"color: hsl(120, 100%, 40%);">+#endif</span><br><span =
style=3D"color: hsl(120, 100%, 40%);">+</span><br><span> /* siphash always =
uses 128-bit keys */</span><br><span> #define SIPHASH_KEY_SIZE 16</span><br=
><span> </span><br><span> /**</span><br><span> * Calculates SIPHASH using =
the reference implementation</span><br><span> */</span><br><span style=3D"=
color: hsl(0, 100%, 40%);">-int</span><br><span style=3D"color: hsl(120, 10=
0%, 40%);">+void</span><br><span> siphash_reference(const void *in, size_t =
inlen, const void *k,</span><br><span> uint8_t *out, size=
_t outlen);</span><br><span> </span><br><span> </span><br><span style=3D"co=
lor: hsl(0, 100%, 40%);">-static inline int</span><br><span style=3D"color:=
hsl(120, 100%, 40%);">+#if defined(OPENSSL_IS_AWSLC)</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+#define USE_CRYPOTOLIB_SIPHASH</span><br>=
<span style=3D"color: hsl(120, 100%, 40%);">+#include <openssl/siphash=
=2Eh></span><br><span style=3D"color: hsl(120, 100%, 40%);">+#include &l=
t;string=2Eh></span><br><span style=3D"color: hsl(120, 100%, 40%);">+#in=
clude "error=2Eh"</span><br><span style=3D"color: hsl(120, 100%, =
40%);">+/**</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ * Comp=
utes a SipHash value</span><br><span style=3D"color: hsl(120, 100%, 40%);">=
+ * @param in pointer to input data (read-only)</span><br><span styl=
e=3D"color: hsl(120, 100%, 40%);">+ * @param inlen input data length in=
bytes (any size_t value)</span><br><span style=3D"color: hsl(120, 100%, 40=
%);">+ * @param k pointer to the key data (read-only), must be 16 b=
ytes</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ * @param out=
pointer to output data (write-only), outlen bytes must be allocated</s=
pan><br><span style=3D"color: hsl(120, 100%, 40%);">+ * @param outlen le=
ngth of the output in bytes, must be 8</span><br><span style=3D"color: hsl(=
120, 100%, 40%);">+ */</span><br><span style=3D"color: hsl(120, 100%, 40%);=
">+static inline void</span><br><span style=3D"color: hsl(120, 100%, 40%);"=
>+siphash_cryptolib(const void *in, const size_t inlen,</span><br><span sty=
le=3D"color: hsl(120, 100%, 40%);">+ const void *k, uint8_=
t *out, const size_t outlen)</span><br><span style=3D"color: hsl(120, 100%,=
40%);">+{</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ ASSER=
T(outlen =3D=3D sizeof(uint64_t));</span><br><span style=3D"color: hsl(120,=
100%, 40%);">+ uint64_t sipout =3D SIPHASH_24(k, in, inlen);</span><br>=
<span style=3D"color: hsl(120, 100%, 40%);">+</span><br><span style=3D"colo=
r: hsl(120, 100%, 40%);">+ memcpy(out, &sipout, sizeof(uint64_t));</=
span><br><span style=3D"color: hsl(120, 100%, 40%);">+}</span><br><span sty=
le=3D"color: hsl(120, 100%, 40%);">+#endif</span><br><span style=3D"color: =
hsl(120, 100%, 40%);">+</span><br><span style=3D"color: hsl(120, 100%, 40%)=
;">+static inline void</span><br><span> siphash(const void *in, size_t inle=
n, const void *k,</span><br><span> uint8_t *out, size_t outlen)</sp=
an><br><span> {</span><br><span style=3D"color: hsl(0, 100%, 40%);">- re=
turn siphash_reference(in, inlen, k, out, outlen);</span><br><span style=3D=
"color: hsl(120, 100%, 40%);">+#if defined(USE_CRYPOTOLIB_SIPHASH)</span><b=
r><span style=3D"color: hsl(120, 100%, 40%);">+ siphash_cryptolib(in, in=
len, k, out, outlen);</span><br><span style=3D"color: hsl(120, 100%, 40%);"=
>+#else</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ siphash_=
reference(in, inlen, k, out, outlen);</span><br><span style=3D"color: hsl(1=
20, 100%, 40%);">+#endif</span><br><span> }</span><br><span> </span><br><sp=
an style=3D"color: hsl(0, 100%, 40%);">-#endif /* ifndef SIPHASH_H */</span=
><br><span>\ No newline at end of file</span><br><span style=3D"color: hsl(=
120, 100%, 40%);">+#endif /* ifndef SIPHASH_H */</span><br><span>diff --git=
a/src/openvpn/siphash_reference=2Ec b/src/openvpn/siphash_reference=2Ec</s=
pan><br><span>index ad19a51=2E=2E5f0adb9 100644</span><br><span>--- a/src/o=
penvpn/siphash_reference=2Ec</span><br><span>+++ b/src/openvpn/siphash_refe=
rence=2Ec</span><br><span>@@ -99,7 +99,7 @@</span><br><span> * out: pointe=
r to output data (write-only), outlen bytes must be allocated</span><br><sp=
an> * outlen: length of the output in bytes, must be 8 or 16</span><br><s=
pan> */</span><br><span style=3D"color: hsl(0, 100%, 40%);">-int</span><br=
><span style=3D"color: hsl(120, 100%, 40%);">+void</span><br><span> siphash=
_reference(const void *in, const size_t inlen, const void *k, uint8_t *out,=
</span><br><span> const size_t outlen)</span><br><span> {=
</span><br><span>@@ -206,7 +206,7 @@</span><br><span> </span><br><span> =
if (outlen =3D=3D 8)</span><br><span> {</span><br><span style=3D"color=
: hsl(0, 100%, 40%);">- return 0;</span><br><span style=3D"color: hs=
l(120, 100%, 40%);">+ return;</span><br><span> }</span><br><span=
> </span><br><span> v1 ^=3D 0xdd;</span><br><span>@@ -219,6 +219,4 @@</=
span><br><span> </span><br><span> b =3D v0 ^ v1 ^ v2 ^ v3;</span><br><s=
pan> U64TO8_LE(out + 8, b);</span><br><span style=3D"color: hsl(0, 100%=
, 40%);">-</span><br><span style=3D"color: hsl(0, 100%, 40%);">- return =
0;</span><br><span> }</span><br><span></span><br></pre><p>To view, visit <a=
href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1572?usp=3Demail">change=
1572</a>=2E To unsubscribe, or for help writing mail filters, visit <a hre=
f=3D"http://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail">settings</a>=2E</p=
><div itemscope itemtype=3D"http://schema=2Eorg/EmailMessage"><div itemscop=
e itemprop=3D"action" itemtype=3D"http://schema=2Eorg/ViewAction"><link ite=
mprop=3D"url" href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1572?usp=3D=
email"/><meta itemprop=3D"name" content=3D"View Change"/></div></div>
<div=
style=3D"display:none"> Gerrit-MessageType: newpatchset </div>
<div style=
=3D"display:none"> Gerrit-Project: openvpn </div>
<div style=3D"display:non=
e"> Gerrit-Branch: master </div>
<div style=3D"display:none"> Gerrit-Change=
-Id: I05e20f8c82494e4abf96fe1e3a73e1c7b9101af6 </div>
<div style=3D"display=
:none"> Gerrit-Change-Number: 1572 </div>
<div style=3D"display:none"> Gerr=
it-PatchSet: 23 </div>
<div style=3D"display:none"> Gerrit-Owner: plaisthos=
<arne-openvpn@rfc2549=2Eorg> </div>
<div style=3D"display:none"> Ger=
rit-Reviewer: flichtenheld <frank@lichtenheld=2Ecom> </div>
<div styl=
e=3D"display:none"> Gerrit-CC: openvpn-devel <openvpn-devel@lists=2Esour=
ceforge=2Enet> </div>
<div style=3D"display:none"> Gerrit-Attention: fli=
chtenheld <frank@lichtenheld=2Ecom> </div>
</body></html>
--nN1E11M24zE=--
--===============2271156238221633128==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============2271156238221633128==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
--===============2271156238221633128==--