algif_rng.c 8.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342
  1. /*
  2. * algif_rng: User-space interface for random number generators
  3. *
  4. * This file provides the user-space API for random number generators.
  5. *
  6. * Copyright (C) 2014, Stephan Mueller <smueller@chronox.de>
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. * 1. Redistributions of source code must retain the above copyright
  12. * notice, and the entire permission notice in its entirety,
  13. * including the disclaimer of warranties.
  14. * 2. Redistributions in binary form must reproduce the above copyright
  15. * notice, this list of conditions and the following disclaimer in the
  16. * documentation and/or other materials provided with the distribution.
  17. * 3. The name of the author may not be used to endorse or promote
  18. * products derived from this software without specific prior
  19. * written permission.
  20. *
  21. * ALTERNATIVELY, this product may be distributed under the terms of
  22. * the GNU General Public License, in which case the provisions of the GPL2
  23. * are required INSTEAD OF the above restrictions. (This clause is
  24. * necessary due to a potential bad interaction between the GPL and
  25. * the restrictions contained in a BSD-style copyright.)
  26. *
  27. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  28. * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  29. * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
  30. * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
  31. * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  32. * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
  33. * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  34. * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  35. * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  36. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  37. * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
  38. * DAMAGE.
  39. */
  40. #include <linux/capability.h>
  41. #include <linux/module.h>
  42. #include <crypto/rng.h>
  43. #include <linux/random.h>
  44. #include <crypto/if_alg.h>
  45. #include <linux/net.h>
  46. #include <net/sock.h>
  47. MODULE_LICENSE("GPL");
  48. MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
  49. MODULE_DESCRIPTION("User-space interface for random number generators");
  50. struct rng_ctx {
  51. #define MAXSIZE 128
  52. unsigned int len;
  53. struct crypto_rng *drng;
  54. u8 *addtl;
  55. size_t addtl_len;
  56. };
  57. struct rng_parent_ctx {
  58. struct crypto_rng *drng;
  59. u8 *entropy;
  60. };
  61. static void rng_reset_addtl(struct rng_ctx *ctx)
  62. {
  63. kfree_sensitive(ctx->addtl);
  64. ctx->addtl = NULL;
  65. ctx->addtl_len = 0;
  66. }
  67. static int _rng_recvmsg(struct crypto_rng *drng, struct msghdr *msg, size_t len,
  68. u8 *addtl, size_t addtl_len)
  69. {
  70. int err = 0;
  71. int genlen = 0;
  72. u8 result[MAXSIZE];
  73. if (len == 0)
  74. return 0;
  75. if (len > MAXSIZE)
  76. len = MAXSIZE;
  77. /*
  78. * although not strictly needed, this is a precaution against coding
  79. * errors
  80. */
  81. memset(result, 0, len);
  82. /*
  83. * The enforcement of a proper seeding of an RNG is done within an
  84. * RNG implementation. Some RNGs (DRBG, krng) do not need specific
  85. * seeding as they automatically seed. The X9.31 DRNG will return
  86. * an error if it was not seeded properly.
  87. */
  88. genlen = crypto_rng_generate(drng, addtl, addtl_len, result, len);
  89. if (genlen < 0)
  90. return genlen;
  91. err = memcpy_to_msg(msg, result, len);
  92. memzero_explicit(result, len);
  93. return err ? err : len;
  94. }
  95. static int rng_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
  96. int flags)
  97. {
  98. struct sock *sk = sock->sk;
  99. struct alg_sock *ask = alg_sk(sk);
  100. struct rng_ctx *ctx = ask->private;
  101. return _rng_recvmsg(ctx->drng, msg, len, NULL, 0);
  102. }
  103. static int rng_test_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
  104. int flags)
  105. {
  106. struct sock *sk = sock->sk;
  107. struct alg_sock *ask = alg_sk(sk);
  108. struct rng_ctx *ctx = ask->private;
  109. int ret;
  110. lock_sock(sock->sk);
  111. ret = _rng_recvmsg(ctx->drng, msg, len, ctx->addtl, ctx->addtl_len);
  112. rng_reset_addtl(ctx);
  113. release_sock(sock->sk);
  114. return ret;
  115. }
  116. static int rng_test_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
  117. {
  118. int err;
  119. struct alg_sock *ask = alg_sk(sock->sk);
  120. struct rng_ctx *ctx = ask->private;
  121. lock_sock(sock->sk);
  122. if (len > MAXSIZE) {
  123. err = -EMSGSIZE;
  124. goto unlock;
  125. }
  126. rng_reset_addtl(ctx);
  127. ctx->addtl = kmalloc(len, GFP_KERNEL);
  128. if (!ctx->addtl) {
  129. err = -ENOMEM;
  130. goto unlock;
  131. }
  132. err = memcpy_from_msg(ctx->addtl, msg, len);
  133. if (err) {
  134. rng_reset_addtl(ctx);
  135. goto unlock;
  136. }
  137. ctx->addtl_len = len;
  138. unlock:
  139. release_sock(sock->sk);
  140. return err ? err : len;
  141. }
  142. static struct proto_ops algif_rng_ops = {
  143. .family = PF_ALG,
  144. .connect = sock_no_connect,
  145. .socketpair = sock_no_socketpair,
  146. .getname = sock_no_getname,
  147. .ioctl = sock_no_ioctl,
  148. .listen = sock_no_listen,
  149. .shutdown = sock_no_shutdown,
  150. .mmap = sock_no_mmap,
  151. .bind = sock_no_bind,
  152. .accept = sock_no_accept,
  153. .sendmsg = sock_no_sendmsg,
  154. .sendpage = sock_no_sendpage,
  155. .release = af_alg_release,
  156. .recvmsg = rng_recvmsg,
  157. };
  158. static struct proto_ops __maybe_unused algif_rng_test_ops = {
  159. .family = PF_ALG,
  160. .connect = sock_no_connect,
  161. .socketpair = sock_no_socketpair,
  162. .getname = sock_no_getname,
  163. .ioctl = sock_no_ioctl,
  164. .listen = sock_no_listen,
  165. .shutdown = sock_no_shutdown,
  166. .mmap = sock_no_mmap,
  167. .bind = sock_no_bind,
  168. .accept = sock_no_accept,
  169. .sendpage = sock_no_sendpage,
  170. .release = af_alg_release,
  171. .recvmsg = rng_test_recvmsg,
  172. .sendmsg = rng_test_sendmsg,
  173. };
  174. static void *rng_bind(const char *name, u32 type, u32 mask)
  175. {
  176. struct rng_parent_ctx *pctx;
  177. struct crypto_rng *rng;
  178. pctx = kzalloc(sizeof(*pctx), GFP_KERNEL);
  179. if (!pctx)
  180. return ERR_PTR(-ENOMEM);
  181. rng = crypto_alloc_rng(name, type, mask);
  182. if (IS_ERR(rng)) {
  183. kfree(pctx);
  184. return ERR_CAST(rng);
  185. }
  186. pctx->drng = rng;
  187. return pctx;
  188. }
  189. static void rng_release(void *private)
  190. {
  191. struct rng_parent_ctx *pctx = private;
  192. if (unlikely(!pctx))
  193. return;
  194. crypto_free_rng(pctx->drng);
  195. kfree_sensitive(pctx->entropy);
  196. kfree_sensitive(pctx);
  197. }
  198. static void rng_sock_destruct(struct sock *sk)
  199. {
  200. struct alg_sock *ask = alg_sk(sk);
  201. struct rng_ctx *ctx = ask->private;
  202. rng_reset_addtl(ctx);
  203. sock_kfree_s(sk, ctx, ctx->len);
  204. af_alg_release_parent(sk);
  205. }
  206. static int rng_accept_parent(void *private, struct sock *sk)
  207. {
  208. struct rng_ctx *ctx;
  209. struct rng_parent_ctx *pctx = private;
  210. struct alg_sock *ask = alg_sk(sk);
  211. unsigned int len = sizeof(*ctx);
  212. ctx = sock_kmalloc(sk, len, GFP_KERNEL);
  213. if (!ctx)
  214. return -ENOMEM;
  215. ctx->len = len;
  216. ctx->addtl = NULL;
  217. ctx->addtl_len = 0;
  218. /*
  219. * No seeding done at that point -- if multiple accepts are
  220. * done on one RNG instance, each resulting FD points to the same
  221. * state of the RNG.
  222. */
  223. ctx->drng = pctx->drng;
  224. ask->private = ctx;
  225. sk->sk_destruct = rng_sock_destruct;
  226. /*
  227. * Non NULL pctx->entropy means that CAVP test has been initiated on
  228. * this socket, replace proto_ops algif_rng_ops with algif_rng_test_ops.
  229. */
  230. if (IS_ENABLED(CONFIG_CRYPTO_USER_API_RNG_CAVP) && pctx->entropy)
  231. sk->sk_socket->ops = &algif_rng_test_ops;
  232. return 0;
  233. }
  234. static int rng_setkey(void *private, const u8 *seed, unsigned int seedlen)
  235. {
  236. struct rng_parent_ctx *pctx = private;
  237. /*
  238. * Check whether seedlen is of sufficient size is done in RNG
  239. * implementations.
  240. */
  241. return crypto_rng_reset(pctx->drng, seed, seedlen);
  242. }
  243. static int __maybe_unused rng_setentropy(void *private, sockptr_t entropy,
  244. unsigned int len)
  245. {
  246. struct rng_parent_ctx *pctx = private;
  247. u8 *kentropy = NULL;
  248. if (!capable(CAP_SYS_ADMIN))
  249. return -EACCES;
  250. if (pctx->entropy)
  251. return -EINVAL;
  252. if (len > MAXSIZE)
  253. return -EMSGSIZE;
  254. if (len) {
  255. kentropy = memdup_sockptr(entropy, len);
  256. if (IS_ERR(kentropy))
  257. return PTR_ERR(kentropy);
  258. }
  259. crypto_rng_alg(pctx->drng)->set_ent(pctx->drng, kentropy, len);
  260. /*
  261. * Since rng doesn't perform any memory management for the entropy
  262. * buffer, save kentropy pointer to pctx now to free it after use.
  263. */
  264. pctx->entropy = kentropy;
  265. return 0;
  266. }
  267. static const struct af_alg_type algif_type_rng = {
  268. .bind = rng_bind,
  269. .release = rng_release,
  270. .accept = rng_accept_parent,
  271. .setkey = rng_setkey,
  272. #ifdef CONFIG_CRYPTO_USER_API_RNG_CAVP
  273. .setentropy = rng_setentropy,
  274. #endif
  275. .ops = &algif_rng_ops,
  276. .name = "rng",
  277. .owner = THIS_MODULE
  278. };
  279. static int __init rng_init(void)
  280. {
  281. return af_alg_register_type(&algif_type_rng);
  282. }
  283. static void __exit rng_exit(void)
  284. {
  285. int err = af_alg_unregister_type(&algif_type_rng);
  286. BUG_ON(err);
  287. }
  288. module_init(rng_init);
  289. module_exit(rng_exit);