esp: add sha256 hmac.

Author: philljj

scripts/ip-xfrm/hmac_auth

@@ -3,9 +3,20 @@
 # hmac-[md5,sha1]-96 example.
 #
 
+print_usage_and_die() {
+  echo "usage:"
+  echo "  hmac_auth [auth]"
+  echo "  auth = md5, sha1, sha256"
+  exit 1
+}
+
 alg=sha1
 ip_proto=tcp
 
+if [ $# -eq 0 ]; then
+  print_usage_and_die
+fi
+
 if [ $# -eq 1 ]; then
   alg=$1
 fi

src/wolfesp.c

@@ -6,16 +6,17 @@
 #define ESP_PADDING_LEN      1
 #define ESP_NEXT_HEADER_LEN  1
 #define ESP_ICV_ALIGNMENT    4
-/* hmac-[sha1, md5]-96*/
+/* hmac-[sha256, sha1, md5]-96*/
 #define ESP_ICVLEN_HMAC_96   12
 #define WOLFIP_ESP_NUM_SA    1
 
 typedef enum {
   ESP_AUTH_NONE = 0,
-  ESP_AUTH_SHA1,        /* hmac(sha1)-96 */
-  ESP_AUTH_MD5,         /* hmac(md5)-96 */
-  ESP_AUTH_GCM_RFC4106, /* placeholder to indicate gcm auth. */
-  ESP_AUTH_GCM_RFC4543  /* rfc4543 gmac */
+  ESP_AUTH_MD5_RFC2403,    /* hmac(md5)-96 */
+  ESP_AUTH_SHA1_RFC2404,   /* hmac(sha1)-96 */
+  ESP_AUTH_SHA256_RFC4868, /* hmac(sha256)-96 */
+  ESP_AUTH_GCM_RFC4106,    /* placeholder to indicate gcm auth. */
+  ESP_AUTH_GCM_RFC4543     /* rfc4543 gmac */
 } esp_auth_t;
 
 /* Minimal ESP Security Association structure.
@@ -44,7 +45,7 @@ struct wolfIP_esp_sa in_sa_list[WOLFIP_ESP_NUM_SA] =
         0x020A0A0A, /* dst */
         0,0, /* oseq, seq */
         0, /* iv len */
-        ESP_AUTH_MD5,
+        ESP_AUTH_SHA256_RFC4868,
         {0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
          0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01},
         16,
@@ -60,7 +61,7 @@ struct wolfIP_esp_sa out_sa_list[WOLFIP_ESP_NUM_SA] =
         0x010A0A0A, /* dst */
         0,0, /* oseq, seq */
         0, /* iv len */
-        ESP_AUTH_MD5,
+        ESP_AUTH_SHA256_RFC4868,
         {0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
          0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02},
         16,
@@ -223,11 +224,14 @@ esp_calc_icv_hmac(uint8_t * hash, const struct wolfIP_esp_sa * esp_sa,
     uint32_t  auth_len = esp_len;
 
     switch (esp_sa->auth) {
-    case ESP_AUTH_SHA1:
+    case ESP_AUTH_MD5_RFC2403:
+        type = WC_MD5;
+        break;
+    case ESP_AUTH_SHA1_RFC2404:
         type = WC_SHA;
         break;
-    case ESP_AUTH_MD5:
-        type = WC_MD5;
+    case ESP_AUTH_SHA256_RFC4868:
+        type = WC_SHA256;
         break;
     case ESP_AUTH_NONE:
     default:
@@ -295,12 +299,13 @@ esp_check_icv_hmac(const struct wolfIP_esp_sa * esp_sa, uint8_t * esp_data,
                    uint32_t esp_len)
 {
     /* SHA1 and MD5 have these digest sizes:
-     *   - WC_SHA_DIGEST_SIZE 20 bytes
-     *   - WC_MD5_DIGEST_SIZE 16 bytes
+     *   - WC_MD5_DIGEST_SIZE    16 bytes
+     *   - WC_SHA_DIGEST_SIZE    20 bytes
+     *   - WC_SHA256_DIGEST_SIZE 32 bytes
      * */
     int              rc = 0;
     const uint8_t *  icv = NULL;
-    byte             hash[WC_SHA_DIGEST_SIZE];
+    byte             hash[WC_SHA256_DIGEST_SIZE];
 
     rc = esp_calc_icv_hmac(hash, esp_sa, esp_data, esp_len);
     if (rc) {