authenc.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * Authenc: Simple AEAD wrapper for IPsec
  4. *
  5. * Copyright (c) 2007-2015 Herbert Xu <herbert@gondor.apana.org.au>
  6. */
  7. #include <crypto/internal/aead.h>
  8. #include <crypto/internal/hash.h>
  9. #include <crypto/internal/skcipher.h>
  10. #include <crypto/authenc.h>
  11. #include <crypto/null.h>
  12. #include <crypto/scatterwalk.h>
  13. #include <linux/err.h>
  14. #include <linux/init.h>
  15. #include <linux/kernel.h>
  16. #include <linux/module.h>
  17. #include <linux/rtnetlink.h>
  18. #include <linux/slab.h>
  19. #include <linux/spinlock.h>
  20. struct authenc_instance_ctx {
  21. struct crypto_ahash_spawn auth;
  22. struct crypto_skcipher_spawn enc;
  23. unsigned int reqoff;
  24. };
  25. struct crypto_authenc_ctx {
  26. struct crypto_ahash *auth;
  27. struct crypto_skcipher *enc;
  28. struct crypto_sync_skcipher *null;
  29. };
  30. struct authenc_request_ctx {
  31. struct scatterlist src[2];
  32. struct scatterlist dst[2];
  33. char tail[];
  34. };
  35. static void authenc_request_complete(struct aead_request *req, int err)
  36. {
  37. if (err != -EINPROGRESS)
  38. aead_request_complete(req, err);
  39. }
  40. int crypto_authenc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key,
  41. unsigned int keylen)
  42. {
  43. struct rtattr *rta = (struct rtattr *)key;
  44. struct crypto_authenc_key_param *param;
  45. if (!RTA_OK(rta, keylen))
  46. return -EINVAL;
  47. if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
  48. return -EINVAL;
  49. /*
  50. * RTA_OK() didn't align the rtattr's payload when validating that it
  51. * fits in the buffer. Yet, the keys should start on the next 4-byte
  52. * aligned boundary. To avoid confusion, require that the rtattr
  53. * payload be exactly the param struct, which has a 4-byte aligned size.
  54. */
  55. if (RTA_PAYLOAD(rta) != sizeof(*param))
  56. return -EINVAL;
  57. BUILD_BUG_ON(sizeof(*param) % RTA_ALIGNTO);
  58. param = RTA_DATA(rta);
  59. keys->enckeylen = be32_to_cpu(param->enckeylen);
  60. key += rta->rta_len;
  61. keylen -= rta->rta_len;
  62. if (keylen < keys->enckeylen)
  63. return -EINVAL;
  64. keys->authkeylen = keylen - keys->enckeylen;
  65. keys->authkey = key;
  66. keys->enckey = key + keys->authkeylen;
  67. return 0;
  68. }
  69. EXPORT_SYMBOL_GPL(crypto_authenc_extractkeys);
  70. static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key,
  71. unsigned int keylen)
  72. {
  73. struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
  74. struct crypto_ahash *auth = ctx->auth;
  75. struct crypto_skcipher *enc = ctx->enc;
  76. struct crypto_authenc_keys keys;
  77. int err = -EINVAL;
  78. if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
  79. goto out;
  80. crypto_ahash_clear_flags(auth, CRYPTO_TFM_REQ_MASK);
  81. crypto_ahash_set_flags(auth, crypto_aead_get_flags(authenc) &
  82. CRYPTO_TFM_REQ_MASK);
  83. err = crypto_ahash_setkey(auth, keys.authkey, keys.authkeylen);
  84. if (err)
  85. goto out;
  86. crypto_skcipher_clear_flags(enc, CRYPTO_TFM_REQ_MASK);
  87. crypto_skcipher_set_flags(enc, crypto_aead_get_flags(authenc) &
  88. CRYPTO_TFM_REQ_MASK);
  89. err = crypto_skcipher_setkey(enc, keys.enckey, keys.enckeylen);
  90. out:
  91. memzero_explicit(&keys, sizeof(keys));
  92. return err;
  93. }
  94. static void authenc_geniv_ahash_done(struct crypto_async_request *areq, int err)
  95. {
  96. struct aead_request *req = areq->data;
  97. struct crypto_aead *authenc = crypto_aead_reqtfm(req);
  98. struct aead_instance *inst = aead_alg_instance(authenc);
  99. struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
  100. struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
  101. struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
  102. if (err)
  103. goto out;
  104. scatterwalk_map_and_copy(ahreq->result, req->dst,
  105. req->assoclen + req->cryptlen,
  106. crypto_aead_authsize(authenc), 1);
  107. out:
  108. aead_request_complete(req, err);
  109. }
  110. static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags)
  111. {
  112. struct crypto_aead *authenc = crypto_aead_reqtfm(req);
  113. struct aead_instance *inst = aead_alg_instance(authenc);
  114. struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
  115. struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
  116. struct crypto_ahash *auth = ctx->auth;
  117. struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
  118. struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
  119. u8 *hash = areq_ctx->tail;
  120. int err;
  121. hash = (u8 *)ALIGN((unsigned long)hash + crypto_ahash_alignmask(auth),
  122. crypto_ahash_alignmask(auth) + 1);
  123. ahash_request_set_tfm(ahreq, auth);
  124. ahash_request_set_crypt(ahreq, req->dst, hash,
  125. req->assoclen + req->cryptlen);
  126. ahash_request_set_callback(ahreq, flags,
  127. authenc_geniv_ahash_done, req);
  128. err = crypto_ahash_digest(ahreq);
  129. if (err)
  130. return err;
  131. scatterwalk_map_and_copy(hash, req->dst, req->assoclen + req->cryptlen,
  132. crypto_aead_authsize(authenc), 1);
  133. return 0;
  134. }
  135. static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
  136. int err)
  137. {
  138. struct aead_request *areq = req->data;
  139. if (err)
  140. goto out;
  141. err = crypto_authenc_genicv(areq, 0);
  142. out:
  143. authenc_request_complete(areq, err);
  144. }
  145. static int crypto_authenc_copy_assoc(struct aead_request *req)
  146. {
  147. struct crypto_aead *authenc = crypto_aead_reqtfm(req);
  148. struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
  149. SYNC_SKCIPHER_REQUEST_ON_STACK(skreq, ctx->null);
  150. skcipher_request_set_sync_tfm(skreq, ctx->null);
  151. skcipher_request_set_callback(skreq, aead_request_flags(req),
  152. NULL, NULL);
  153. skcipher_request_set_crypt(skreq, req->src, req->dst, req->assoclen,
  154. NULL);
  155. return crypto_skcipher_encrypt(skreq);
  156. }
  157. static int crypto_authenc_encrypt(struct aead_request *req)
  158. {
  159. struct crypto_aead *authenc = crypto_aead_reqtfm(req);
  160. struct aead_instance *inst = aead_alg_instance(authenc);
  161. struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
  162. struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
  163. struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
  164. struct crypto_skcipher *enc = ctx->enc;
  165. unsigned int cryptlen = req->cryptlen;
  166. struct skcipher_request *skreq = (void *)(areq_ctx->tail +
  167. ictx->reqoff);
  168. struct scatterlist *src, *dst;
  169. int err;
  170. src = scatterwalk_ffwd(areq_ctx->src, req->src, req->assoclen);
  171. dst = src;
  172. if (req->src != req->dst) {
  173. err = crypto_authenc_copy_assoc(req);
  174. if (err)
  175. return err;
  176. dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen);
  177. }
  178. skcipher_request_set_tfm(skreq, enc);
  179. skcipher_request_set_callback(skreq, aead_request_flags(req),
  180. crypto_authenc_encrypt_done, req);
  181. skcipher_request_set_crypt(skreq, src, dst, cryptlen, req->iv);
  182. err = crypto_skcipher_encrypt(skreq);
  183. if (err)
  184. return err;
  185. return crypto_authenc_genicv(req, aead_request_flags(req));
  186. }
  187. static int crypto_authenc_decrypt_tail(struct aead_request *req,
  188. unsigned int flags)
  189. {
  190. struct crypto_aead *authenc = crypto_aead_reqtfm(req);
  191. struct aead_instance *inst = aead_alg_instance(authenc);
  192. struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
  193. struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
  194. struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
  195. struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
  196. struct skcipher_request *skreq = (void *)(areq_ctx->tail +
  197. ictx->reqoff);
  198. unsigned int authsize = crypto_aead_authsize(authenc);
  199. u8 *ihash = ahreq->result + authsize;
  200. struct scatterlist *src, *dst;
  201. scatterwalk_map_and_copy(ihash, req->src, ahreq->nbytes, authsize, 0);
  202. if (crypto_memneq(ihash, ahreq->result, authsize))
  203. return -EBADMSG;
  204. src = scatterwalk_ffwd(areq_ctx->src, req->src, req->assoclen);
  205. dst = src;
  206. if (req->src != req->dst)
  207. dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen);
  208. skcipher_request_set_tfm(skreq, ctx->enc);
  209. skcipher_request_set_callback(skreq, flags,
  210. req->base.complete, req->base.data);
  211. skcipher_request_set_crypt(skreq, src, dst,
  212. req->cryptlen - authsize, req->iv);
  213. return crypto_skcipher_decrypt(skreq);
  214. }
  215. static void authenc_verify_ahash_done(struct crypto_async_request *areq,
  216. int err)
  217. {
  218. struct aead_request *req = areq->data;
  219. if (err)
  220. goto out;
  221. err = crypto_authenc_decrypt_tail(req, 0);
  222. out:
  223. authenc_request_complete(req, err);
  224. }
  225. static int crypto_authenc_decrypt(struct aead_request *req)
  226. {
  227. struct crypto_aead *authenc = crypto_aead_reqtfm(req);
  228. unsigned int authsize = crypto_aead_authsize(authenc);
  229. struct aead_instance *inst = aead_alg_instance(authenc);
  230. struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
  231. struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
  232. struct crypto_ahash *auth = ctx->auth;
  233. struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
  234. struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
  235. u8 *hash = areq_ctx->tail;
  236. int err;
  237. hash = (u8 *)ALIGN((unsigned long)hash + crypto_ahash_alignmask(auth),
  238. crypto_ahash_alignmask(auth) + 1);
  239. ahash_request_set_tfm(ahreq, auth);
  240. ahash_request_set_crypt(ahreq, req->src, hash,
  241. req->assoclen + req->cryptlen - authsize);
  242. ahash_request_set_callback(ahreq, aead_request_flags(req),
  243. authenc_verify_ahash_done, req);
  244. err = crypto_ahash_digest(ahreq);
  245. if (err)
  246. return err;
  247. return crypto_authenc_decrypt_tail(req, aead_request_flags(req));
  248. }
  249. static int crypto_authenc_init_tfm(struct crypto_aead *tfm)
  250. {
  251. struct aead_instance *inst = aead_alg_instance(tfm);
  252. struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
  253. struct crypto_authenc_ctx *ctx = crypto_aead_ctx(tfm);
  254. struct crypto_ahash *auth;
  255. struct crypto_skcipher *enc;
  256. struct crypto_sync_skcipher *null;
  257. int err;
  258. auth = crypto_spawn_ahash(&ictx->auth);
  259. if (IS_ERR(auth))
  260. return PTR_ERR(auth);
  261. enc = crypto_spawn_skcipher(&ictx->enc);
  262. err = PTR_ERR(enc);
  263. if (IS_ERR(enc))
  264. goto err_free_ahash;
  265. null = crypto_get_default_null_skcipher();
  266. err = PTR_ERR(null);
  267. if (IS_ERR(null))
  268. goto err_free_skcipher;
  269. ctx->auth = auth;
  270. ctx->enc = enc;
  271. ctx->null = null;
  272. crypto_aead_set_reqsize(
  273. tfm,
  274. sizeof(struct authenc_request_ctx) +
  275. ictx->reqoff +
  276. max_t(unsigned int,
  277. crypto_ahash_reqsize(auth) +
  278. sizeof(struct ahash_request),
  279. sizeof(struct skcipher_request) +
  280. crypto_skcipher_reqsize(enc)));
  281. return 0;
  282. err_free_skcipher:
  283. crypto_free_skcipher(enc);
  284. err_free_ahash:
  285. crypto_free_ahash(auth);
  286. return err;
  287. }
  288. static void crypto_authenc_exit_tfm(struct crypto_aead *tfm)
  289. {
  290. struct crypto_authenc_ctx *ctx = crypto_aead_ctx(tfm);
  291. crypto_free_ahash(ctx->auth);
  292. crypto_free_skcipher(ctx->enc);
  293. crypto_put_default_null_skcipher();
  294. }
  295. static void crypto_authenc_free(struct aead_instance *inst)
  296. {
  297. struct authenc_instance_ctx *ctx = aead_instance_ctx(inst);
  298. crypto_drop_skcipher(&ctx->enc);
  299. crypto_drop_ahash(&ctx->auth);
  300. kfree(inst);
  301. }
  302. static int crypto_authenc_create(struct crypto_template *tmpl,
  303. struct rtattr **tb)
  304. {
  305. u32 mask;
  306. struct aead_instance *inst;
  307. struct authenc_instance_ctx *ctx;
  308. struct hash_alg_common *auth;
  309. struct crypto_alg *auth_base;
  310. struct skcipher_alg *enc;
  311. int err;
  312. err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AEAD, &mask);
  313. if (err)
  314. return err;
  315. inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
  316. if (!inst)
  317. return -ENOMEM;
  318. ctx = aead_instance_ctx(inst);
  319. err = crypto_grab_ahash(&ctx->auth, aead_crypto_instance(inst),
  320. crypto_attr_alg_name(tb[1]), 0, mask);
  321. if (err)
  322. goto err_free_inst;
  323. auth = crypto_spawn_ahash_alg(&ctx->auth);
  324. auth_base = &auth->base;
  325. err = crypto_grab_skcipher(&ctx->enc, aead_crypto_instance(inst),
  326. crypto_attr_alg_name(tb[2]), 0, mask);
  327. if (err)
  328. goto err_free_inst;
  329. enc = crypto_spawn_skcipher_alg(&ctx->enc);
  330. ctx->reqoff = ALIGN(2 * auth->digestsize + auth_base->cra_alignmask,
  331. auth_base->cra_alignmask + 1);
  332. err = -ENAMETOOLONG;
  333. if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
  334. "authenc(%s,%s)", auth_base->cra_name,
  335. enc->base.cra_name) >=
  336. CRYPTO_MAX_ALG_NAME)
  337. goto err_free_inst;
  338. if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
  339. "authenc(%s,%s)", auth_base->cra_driver_name,
  340. enc->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
  341. goto err_free_inst;
  342. inst->alg.base.cra_priority = enc->base.cra_priority * 10 +
  343. auth_base->cra_priority;
  344. inst->alg.base.cra_blocksize = enc->base.cra_blocksize;
  345. inst->alg.base.cra_alignmask = auth_base->cra_alignmask |
  346. enc->base.cra_alignmask;
  347. inst->alg.base.cra_ctxsize = sizeof(struct crypto_authenc_ctx);
  348. inst->alg.ivsize = crypto_skcipher_alg_ivsize(enc);
  349. inst->alg.chunksize = crypto_skcipher_alg_chunksize(enc);
  350. inst->alg.maxauthsize = auth->digestsize;
  351. inst->alg.init = crypto_authenc_init_tfm;
  352. inst->alg.exit = crypto_authenc_exit_tfm;
  353. inst->alg.setkey = crypto_authenc_setkey;
  354. inst->alg.encrypt = crypto_authenc_encrypt;
  355. inst->alg.decrypt = crypto_authenc_decrypt;
  356. inst->free = crypto_authenc_free;
  357. err = aead_register_instance(tmpl, inst);
  358. if (err) {
  359. err_free_inst:
  360. crypto_authenc_free(inst);
  361. }
  362. return err;
  363. }
  364. static struct crypto_template crypto_authenc_tmpl = {
  365. .name = "authenc",
  366. .create = crypto_authenc_create,
  367. .module = THIS_MODULE,
  368. };
  369. static int __init crypto_authenc_module_init(void)
  370. {
  371. return crypto_register_template(&crypto_authenc_tmpl);
  372. }
  373. static void __exit crypto_authenc_module_exit(void)
  374. {
  375. crypto_unregister_template(&crypto_authenc_tmpl);
  376. }
  377. subsys_initcall(crypto_authenc_module_init);
  378. module_exit(crypto_authenc_module_exit);
  379. MODULE_LICENSE("GPL");
  380. MODULE_DESCRIPTION("Simple AEAD wrapper for IPsec");
  381. MODULE_ALIAS_CRYPTO("authenc");