cryptosoft.c revision 1.11
1 /* $NetBSD: cryptosoft.c,v 1.11 2005/11/25 16:41:31 thorpej Exp $ */ 2 /* $FreeBSD: src/sys/opencrypto/cryptosoft.c,v 1.2.2.1 2002/11/21 23:34:23 sam Exp $ */ 3 /* $OpenBSD: cryptosoft.c,v 1.35 2002/04/26 08:43:50 deraadt Exp $ */ 4 5 /* 6 * The author of this code is Angelos D. Keromytis (angelos (at) cis.upenn.edu) 7 * 8 * This code was written by Angelos D. Keromytis in Athens, Greece, in 9 * February 2000. Network Security Technologies Inc. (NSTI) kindly 10 * supported the development of this code. 11 * 12 * Copyright (c) 2000, 2001 Angelos D. Keromytis 13 * 14 * Permission to use, copy, and modify this software with or without fee 15 * is hereby granted, provided that this entire notice is included in 16 * all source code copies of any software which is or includes a copy or 17 * modification of this software. 18 * 19 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 20 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 21 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 22 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 23 * PURPOSE. 24 */ 25 26 #include <sys/cdefs.h> 27 __KERNEL_RCSID(0, "$NetBSD: cryptosoft.c,v 1.11 2005/11/25 16:41:31 thorpej Exp $"); 28 29 #include <sys/param.h> 30 #include <sys/systm.h> 31 #include <sys/malloc.h> 32 #include <sys/mbuf.h> 33 #include <sys/sysctl.h> 34 #include <sys/errno.h> 35 36 #include <opencrypto/cryptodev.h> 37 #include <opencrypto/cryptosoft.h> 38 #include <opencrypto/xform.h> 39 40 #include <opencrypto/cryptosoft_xform.c> 41 42 union authctx { 43 MD5_CTX md5ctx; 44 SHA1_CTX sha1ctx; 45 RMD160_CTX rmd160ctx; 46 SHA256_CTX sha256ctx; 47 SHA384_CTX sha384ctx; 48 SHA512_CTX sha512ctx; 49 }; 50 51 struct swcr_data **swcr_sessions = NULL; 52 u_int32_t swcr_sesnum = 0; 53 int32_t swcr_id = -1; 54 55 #define COPYBACK(x, a, b, c, d) \ 56 (x) == CRYPTO_BUF_MBUF ? m_copyback((struct mbuf *)a,b,c,d) \ 57 : cuio_copyback((struct uio *)a,b,c,d) 58 #define COPYDATA(x, a, b, c, d) \ 59 (x) == CRYPTO_BUF_MBUF ? m_copydata((struct mbuf *)a,b,c,d) \ 60 : cuio_copydata((struct uio *)a,b,c,d) 61 62 static int swcr_encdec(struct cryptodesc *, struct swcr_data *, caddr_t, int); 63 static int swcr_authcompute(struct cryptop *crp, struct cryptodesc *crd, 64 struct swcr_data *sw, caddr_t buf, int outtype); 65 static int swcr_compdec(struct cryptodesc *, struct swcr_data *, caddr_t, int); 66 static int swcr_process(void *, struct cryptop *, int); 67 static int swcr_newsession(void *, u_int32_t *, struct cryptoini *); 68 static int swcr_freesession(void *, u_int64_t); 69 70 /* 71 * Apply a symmetric encryption/decryption algorithm. 72 */ 73 static int 74 swcr_encdec(struct cryptodesc *crd, struct swcr_data *sw, caddr_t buf, 75 int outtype) 76 { 77 unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN], *idat; 78 unsigned char *ivp, piv[EALG_MAX_BLOCK_LEN]; 79 const struct swcr_enc_xform *exf; 80 int i, k, j, blks; 81 int count, ind; 82 83 exf = sw->sw_exf; 84 blks = exf->enc_xform->blocksize; 85 86 /* Check for non-padded data */ 87 if (crd->crd_len % blks) 88 return EINVAL; 89 90 /* Initialize the IV */ 91 if (crd->crd_flags & CRD_F_ENCRYPT) { 92 /* IV explicitly provided ? */ 93 if (crd->crd_flags & CRD_F_IV_EXPLICIT) 94 bcopy(crd->crd_iv, iv, blks); 95 else { 96 /* Get random IV */ 97 for (i = 0; 98 i + sizeof (u_int32_t) < EALG_MAX_BLOCK_LEN; 99 i += sizeof (u_int32_t)) { 100 u_int32_t temp = arc4random(); 101 102 bcopy(&temp, iv + i, sizeof(u_int32_t)); 103 } 104 /* 105 * What if the block size is not a multiple 106 * of sizeof (u_int32_t), which is the size of 107 * what arc4random() returns ? 108 */ 109 if (EALG_MAX_BLOCK_LEN % sizeof (u_int32_t) != 0) { 110 u_int32_t temp = arc4random(); 111 112 bcopy (&temp, iv + i, 113 EALG_MAX_BLOCK_LEN - i); 114 } 115 } 116 117 /* Do we need to write the IV */ 118 if (!(crd->crd_flags & CRD_F_IV_PRESENT)) { 119 COPYBACK(outtype, buf, crd->crd_inject, blks, iv); 120 } 121 122 } else { /* Decryption */ 123 /* IV explicitly provided ? */ 124 if (crd->crd_flags & CRD_F_IV_EXPLICIT) 125 bcopy(crd->crd_iv, iv, blks); 126 else { 127 /* Get IV off buf */ 128 COPYDATA(outtype, buf, crd->crd_inject, blks, iv); 129 } 130 } 131 132 ivp = iv; 133 134 if (outtype == CRYPTO_BUF_CONTIG) { 135 if (crd->crd_flags & CRD_F_ENCRYPT) { 136 for (i = crd->crd_skip; 137 i < crd->crd_skip + crd->crd_len; i += blks) { 138 /* XOR with the IV/previous block, as appropriate. */ 139 if (i == crd->crd_skip) 140 for (k = 0; k < blks; k++) 141 buf[i + k] ^= ivp[k]; 142 else 143 for (k = 0; k < blks; k++) 144 buf[i + k] ^= buf[i + k - blks]; 145 exf->encrypt(sw->sw_kschedule, buf + i); 146 } 147 } else { /* Decrypt */ 148 /* 149 * Start at the end, so we don't need to keep the encrypted 150 * block as the IV for the next block. 151 */ 152 for (i = crd->crd_skip + crd->crd_len - blks; 153 i >= crd->crd_skip; i -= blks) { 154 exf->decrypt(sw->sw_kschedule, buf + i); 155 156 /* XOR with the IV/previous block, as appropriate */ 157 if (i == crd->crd_skip) 158 for (k = 0; k < blks; k++) 159 buf[i + k] ^= ivp[k]; 160 else 161 for (k = 0; k < blks; k++) 162 buf[i + k] ^= buf[i + k - blks]; 163 } 164 } 165 166 return 0; 167 } else if (outtype == CRYPTO_BUF_MBUF) { 168 struct mbuf *m = (struct mbuf *) buf; 169 170 /* Find beginning of data */ 171 m = m_getptr(m, crd->crd_skip, &k); 172 if (m == NULL) 173 return EINVAL; 174 175 i = crd->crd_len; 176 177 while (i > 0) { 178 /* 179 * If there's insufficient data at the end of 180 * an mbuf, we have to do some copying. 181 */ 182 if (m->m_len < k + blks && m->m_len != k) { 183 m_copydata(m, k, blks, blk); 184 185 /* Actual encryption/decryption */ 186 if (crd->crd_flags & CRD_F_ENCRYPT) { 187 /* XOR with previous block */ 188 for (j = 0; j < blks; j++) 189 blk[j] ^= ivp[j]; 190 191 exf->encrypt(sw->sw_kschedule, blk); 192 193 /* 194 * Keep encrypted block for XOR'ing 195 * with next block 196 */ 197 bcopy(blk, iv, blks); 198 ivp = iv; 199 } else { /* decrypt */ 200 /* 201 * Keep encrypted block for XOR'ing 202 * with next block 203 */ 204 if (ivp == iv) 205 bcopy(blk, piv, blks); 206 else 207 bcopy(blk, iv, blks); 208 209 exf->decrypt(sw->sw_kschedule, blk); 210 211 /* XOR with previous block */ 212 for (j = 0; j < blks; j++) 213 blk[j] ^= ivp[j]; 214 215 if (ivp == iv) 216 bcopy(piv, iv, blks); 217 else 218 ivp = iv; 219 } 220 221 /* Copy back decrypted block */ 222 m_copyback(m, k, blks, blk); 223 224 /* Advance pointer */ 225 m = m_getptr(m, k + blks, &k); 226 if (m == NULL) 227 return EINVAL; 228 229 i -= blks; 230 231 /* Could be done... */ 232 if (i == 0) 233 break; 234 } 235 236 /* Skip possibly empty mbufs */ 237 if (k == m->m_len) { 238 for (m = m->m_next; m && m->m_len == 0; 239 m = m->m_next) 240 ; 241 k = 0; 242 } 243 244 /* Sanity check */ 245 if (m == NULL) 246 return EINVAL; 247 248 /* 249 * Warning: idat may point to garbage here, but 250 * we only use it in the while() loop, only if 251 * there are indeed enough data. 252 */ 253 idat = mtod(m, unsigned char *) + k; 254 255 while (m->m_len >= k + blks && i > 0) { 256 if (crd->crd_flags & CRD_F_ENCRYPT) { 257 /* XOR with previous block/IV */ 258 for (j = 0; j < blks; j++) 259 idat[j] ^= ivp[j]; 260 261 exf->encrypt(sw->sw_kschedule, idat); 262 ivp = idat; 263 } else { /* decrypt */ 264 /* 265 * Keep encrypted block to be used 266 * in next block's processing. 267 */ 268 if (ivp == iv) 269 bcopy(idat, piv, blks); 270 else 271 bcopy(idat, iv, blks); 272 273 exf->decrypt(sw->sw_kschedule, idat); 274 275 /* XOR with previous block/IV */ 276 for (j = 0; j < blks; j++) 277 idat[j] ^= ivp[j]; 278 279 if (ivp == iv) 280 bcopy(piv, iv, blks); 281 else 282 ivp = iv; 283 } 284 285 idat += blks; 286 k += blks; 287 i -= blks; 288 } 289 } 290 291 return 0; /* Done with mbuf encryption/decryption */ 292 } else if (outtype == CRYPTO_BUF_IOV) { 293 struct uio *uio = (struct uio *) buf; 294 295 #ifdef __FreeBSD__ 296 struct iovec *iov; 297 /* Find beginning of data */ 298 iov = cuio_getptr(uio, crd->crd_skip, &k); 299 if (iov == NULL) 300 return EINVAL; 301 302 i = crd->crd_len; 303 304 while (i > 0) { 305 /* 306 * If there's insufficient data at the end of 307 * an iovec, we have to do some copying. 308 */ 309 if (iov->iov_len < k + blks && iov->iov_len != k) { 310 cuio_copydata(uio, k, blks, blk); 311 312 /* Actual encryption/decryption */ 313 if (crd->crd_flags & CRD_F_ENCRYPT) { 314 /* XOR with previous block */ 315 for (j = 0; j < blks; j++) 316 blk[j] ^= ivp[j]; 317 318 exf->encrypt(sw->sw_kschedule, blk); 319 320 /* 321 * Keep encrypted block for XOR'ing 322 * with next block 323 */ 324 bcopy(blk, iv, blks); 325 ivp = iv; 326 } else { /* decrypt */ 327 /* 328 * Keep encrypted block for XOR'ing 329 * with next block 330 */ 331 if (ivp == iv) 332 bcopy(blk, piv, blks); 333 else 334 bcopy(blk, iv, blks); 335 336 exf->decrypt(sw->sw_kschedule, blk); 337 338 /* XOR with previous block */ 339 for (j = 0; j < blks; j++) 340 blk[j] ^= ivp[j]; 341 342 if (ivp == iv) 343 bcopy(piv, iv, blks); 344 else 345 ivp = iv; 346 } 347 348 /* Copy back decrypted block */ 349 cuio_copyback(uio, k, blks, blk); 350 351 /* Advance pointer */ 352 iov = cuio_getptr(uio, k + blks, &k); 353 if (iov == NULL) 354 return EINVAL; 355 356 i -= blks; 357 358 /* Could be done... */ 359 if (i == 0) 360 break; 361 } 362 363 /* 364 * Warning: idat may point to garbage here, but 365 * we only use it in the while() loop, only if 366 * there are indeed enough data. 367 */ 368 idat = (char *)iov->iov_base + k; 369 370 while (iov->iov_len >= k + blks && i > 0) { 371 if (crd->crd_flags & CRD_F_ENCRYPT) { 372 /* XOR with previous block/IV */ 373 for (j = 0; j < blks; j++) 374 idat[j] ^= ivp[j]; 375 376 exf->encrypt(sw->sw_kschedule, idat); 377 ivp = idat; 378 } else { /* decrypt */ 379 /* 380 * Keep encrypted block to be used 381 * in next block's processing. 382 */ 383 if (ivp == iv) 384 bcopy(idat, piv, blks); 385 else 386 bcopy(idat, iv, blks); 387 388 exf->decrypt(sw->sw_kschedule, idat); 389 390 /* XOR with previous block/IV */ 391 for (j = 0; j < blks; j++) 392 idat[j] ^= ivp[j]; 393 394 if (ivp == iv) 395 bcopy(piv, iv, blks); 396 else 397 ivp = iv; 398 } 399 400 idat += blks; 401 k += blks; 402 i -= blks; 403 } 404 } 405 406 return 0; /* Done with mbuf encryption/decryption */ 407 #else /* !freebsd iov */ 408 /* Find beginning of data */ 409 count = crd->crd_skip; 410 ind = cuio_getptr(uio, count, &k); 411 if (ind == -1) 412 return EINVAL; 413 414 i = crd->crd_len; 415 416 while (i > 0) { 417 /* 418 * If there's insufficient data at the end, 419 * we have to do some copying. 420 */ 421 if (uio->uio_iov[ind].iov_len < k + blks && 422 uio->uio_iov[ind].iov_len != k) { 423 cuio_copydata(uio, k, blks, blk); 424 425 /* Actual encryption/decryption */ 426 if (crd->crd_flags & CRD_F_ENCRYPT) { 427 /* XOR with previous block */ 428 for (j = 0; j < blks; j++) 429 blk[j] ^= ivp[j]; 430 431 exf->encrypt(sw->sw_kschedule, blk); 432 433 /* 434 * Keep encrypted block for XOR'ing 435 * with next block 436 */ 437 bcopy(blk, iv, blks); 438 ivp = iv; 439 } else { /* decrypt */ 440 /* 441 * Keep encrypted block for XOR'ing 442 * with next block 443 */ 444 if (ivp == iv) 445 bcopy(blk, piv, blks); 446 else 447 bcopy(blk, iv, blks); 448 449 exf->decrypt(sw->sw_kschedule, blk); 450 451 /* XOR with previous block */ 452 for (j = 0; j < blks; j++) 453 blk[j] ^= ivp[j]; 454 455 if (ivp == iv) 456 bcopy(piv, iv, blks); 457 else 458 ivp = iv; 459 } 460 461 /* Copy back decrypted block */ 462 cuio_copyback(uio, k, blks, blk); 463 464 count += blks; 465 466 /* Advance pointer */ 467 ind = cuio_getptr(uio, count, &k); 468 if (ind == -1) 469 return (EINVAL); 470 471 i -= blks; 472 473 /* Could be done... */ 474 if (i == 0) 475 break; 476 } 477 478 /* 479 * Warning: idat may point to garbage here, but 480 * we only use it in the while() loop, only if 481 * there are indeed enough data. 482 */ 483 idat = ((caddr_t)uio->uio_iov[ind].iov_base) + k; 484 485 while (uio->uio_iov[ind].iov_len >= k + blks && 486 i > 0) { 487 if (crd->crd_flags & CRD_F_ENCRYPT) { 488 /* XOR with previous block/IV */ 489 for (j = 0; j < blks; j++) 490 idat[j] ^= ivp[j]; 491 492 exf->encrypt(sw->sw_kschedule, idat); 493 ivp = idat; 494 } else { /* decrypt */ 495 /* 496 * Keep encrypted block to be used 497 * in next block's processing. 498 */ 499 if (ivp == iv) 500 bcopy(idat, piv, blks); 501 else 502 bcopy(idat, iv, blks); 503 504 exf->decrypt(sw->sw_kschedule, idat); 505 506 /* XOR with previous block/IV */ 507 for (j = 0; j < blks; j++) 508 idat[j] ^= ivp[j]; 509 510 if (ivp == iv) 511 bcopy(piv, iv, blks); 512 else 513 ivp = iv; 514 } 515 516 idat += blks; 517 count += blks; 518 k += blks; 519 i -= blks; 520 } 521 } 522 #endif 523 return 0; /* Done with mbuf encryption/decryption */ 524 } 525 526 /* Unreachable */ 527 return EINVAL; 528 } 529 530 /* 531 * Compute keyed-hash authenticator. 532 */ 533 static int 534 swcr_authcompute(struct cryptop *crp, struct cryptodesc *crd, 535 struct swcr_data *sw, caddr_t buf, int outtype) 536 { 537 unsigned char aalg[AALG_MAX_RESULT_LEN]; 538 const struct swcr_auth_hash *axf; 539 union authctx ctx; 540 int err; 541 542 if (sw->sw_ictx == 0) 543 return EINVAL; 544 545 axf = sw->sw_axf; 546 547 bcopy(sw->sw_ictx, &ctx, axf->auth_hash->ctxsize); 548 549 switch (outtype) { 550 case CRYPTO_BUF_CONTIG: 551 axf->Update(&ctx, buf + crd->crd_skip, crd->crd_len); 552 break; 553 case CRYPTO_BUF_MBUF: 554 err = m_apply((struct mbuf *) buf, crd->crd_skip, crd->crd_len, 555 (int (*)(void*, caddr_t, unsigned int)) axf->Update, 556 (caddr_t) &ctx); 557 if (err) 558 return err; 559 break; 560 case CRYPTO_BUF_IOV: 561 #ifdef __FreeBSD__ 562 /*XXX FIXME: handle iov case*/ 563 return EINVAL; 564 #else 565 err = cuio_apply((struct uio *) buf, crd->crd_skip, 566 crd->crd_len, 567 (int (*)(caddr_t, caddr_t, unsigned int)) axf->Update, 568 (caddr_t) &ctx); 569 if (err) { 570 return err; 571 } 572 #endif 573 break; 574 default: 575 return EINVAL; 576 } 577 578 switch (sw->sw_alg) { 579 case CRYPTO_MD5_HMAC: 580 case CRYPTO_SHA1_HMAC: 581 case CRYPTO_SHA2_HMAC: 582 case CRYPTO_RIPEMD160_HMAC: 583 if (sw->sw_octx == NULL) 584 return EINVAL; 585 586 axf->Final(aalg, &ctx); 587 bcopy(sw->sw_octx, &ctx, axf->auth_hash->ctxsize); 588 axf->Update(&ctx, aalg, axf->auth_hash->hashsize); 589 axf->Final(aalg, &ctx); 590 break; 591 592 case CRYPTO_MD5_KPDK: 593 case CRYPTO_SHA1_KPDK: 594 if (sw->sw_octx == NULL) 595 return EINVAL; 596 597 axf->Update(&ctx, sw->sw_octx, sw->sw_klen); 598 axf->Final(aalg, &ctx); 599 break; 600 601 case CRYPTO_NULL_HMAC: 602 case CRYPTO_MD5: 603 case CRYPTO_SHA1: 604 axf->Final(aalg, &ctx); 605 break; 606 } 607 608 /* Inject the authentication data */ 609 switch (outtype) { 610 case CRYPTO_BUF_CONTIG: 611 bcopy(aalg, buf + crd->crd_inject, axf->auth_hash->authsize); 612 break; 613 case CRYPTO_BUF_MBUF: 614 m_copyback((struct mbuf *) buf, crd->crd_inject, 615 axf->auth_hash->authsize, aalg); 616 break; 617 case CRYPTO_BUF_IOV: 618 bcopy(aalg, crp->crp_mac, axf->auth_hash->authsize); 619 break; 620 default: 621 return EINVAL; 622 } 623 return 0; 624 } 625 626 /* 627 * Apply a compression/decompression algorithm 628 */ 629 static int 630 swcr_compdec(struct cryptodesc *crd, struct swcr_data *sw, 631 caddr_t buf, int outtype) 632 { 633 u_int8_t *data, *out; 634 const struct swcr_comp_algo *cxf; 635 int adj; 636 u_int32_t result; 637 638 cxf = sw->sw_cxf; 639 640 /* We must handle the whole buffer of data in one time 641 * then if there is not all the data in the mbuf, we must 642 * copy in a buffer. 643 */ 644 645 MALLOC(data, u_int8_t *, crd->crd_len, M_CRYPTO_DATA, M_NOWAIT); 646 if (data == NULL) 647 return (EINVAL); 648 COPYDATA(outtype, buf, crd->crd_skip, crd->crd_len, data); 649 650 if (crd->crd_flags & CRD_F_COMP) 651 result = cxf->compress(data, crd->crd_len, &out); 652 else 653 result = cxf->decompress(data, crd->crd_len, &out); 654 655 FREE(data, M_CRYPTO_DATA); 656 if (result == 0) 657 return EINVAL; 658 659 /* Copy back the (de)compressed data. m_copyback is 660 * extending the mbuf as necessary. 661 */ 662 sw->sw_size = result; 663 /* Check the compressed size when doing compression */ 664 if (crd->crd_flags & CRD_F_COMP) { 665 if (result > crd->crd_len) { 666 /* Compression was useless, we lost time */ 667 FREE(out, M_CRYPTO_DATA); 668 return 0; 669 } 670 } 671 672 COPYBACK(outtype, buf, crd->crd_skip, result, out); 673 if (result < crd->crd_len) { 674 adj = result - crd->crd_len; 675 if (outtype == CRYPTO_BUF_MBUF) { 676 adj = result - crd->crd_len; 677 m_adj((struct mbuf *)buf, adj); 678 } else { 679 struct uio *uio = (struct uio *)buf; 680 int ind; 681 682 adj = crd->crd_len - result; 683 ind = uio->uio_iovcnt - 1; 684 685 while (adj > 0 && ind >= 0) { 686 if (adj < uio->uio_iov[ind].iov_len) { 687 uio->uio_iov[ind].iov_len -= adj; 688 break; 689 } 690 691 adj -= uio->uio_iov[ind].iov_len; 692 uio->uio_iov[ind].iov_len = 0; 693 ind--; 694 uio->uio_iovcnt--; 695 } 696 } 697 } 698 FREE(out, M_CRYPTO_DATA); 699 return 0; 700 } 701 702 /* 703 * Generate a new software session. 704 */ 705 static int 706 swcr_newsession(void *arg, u_int32_t *sid, struct cryptoini *cri) 707 { 708 struct swcr_data **swd; 709 const struct swcr_auth_hash *axf; 710 const struct swcr_enc_xform *txf; 711 const struct swcr_comp_algo *cxf; 712 u_int32_t i; 713 int k, error; 714 715 if (sid == NULL || cri == NULL) 716 return EINVAL; 717 718 if (swcr_sessions) { 719 for (i = 1; i < swcr_sesnum; i++) 720 if (swcr_sessions[i] == NULL) 721 break; 722 } else 723 i = 1; /* NB: to silence compiler warning */ 724 725 if (swcr_sessions == NULL || i == swcr_sesnum) { 726 if (swcr_sessions == NULL) { 727 i = 1; /* We leave swcr_sessions[0] empty */ 728 swcr_sesnum = CRYPTO_SW_SESSIONS; 729 } else 730 swcr_sesnum *= 2; 731 732 swd = malloc(swcr_sesnum * sizeof(struct swcr_data *), 733 M_CRYPTO_DATA, M_NOWAIT); 734 if (swd == NULL) { 735 /* Reset session number */ 736 if (swcr_sesnum == CRYPTO_SW_SESSIONS) 737 swcr_sesnum = 0; 738 else 739 swcr_sesnum /= 2; 740 return ENOBUFS; 741 } 742 743 bzero(swd, swcr_sesnum * sizeof(struct swcr_data *)); 744 745 /* Copy existing sessions */ 746 if (swcr_sessions) { 747 bcopy(swcr_sessions, swd, 748 (swcr_sesnum / 2) * sizeof(struct swcr_data *)); 749 free(swcr_sessions, M_CRYPTO_DATA); 750 } 751 752 swcr_sessions = swd; 753 } 754 755 swd = &swcr_sessions[i]; 756 *sid = i; 757 758 while (cri) { 759 MALLOC(*swd, struct swcr_data *, sizeof(struct swcr_data), 760 M_CRYPTO_DATA, M_NOWAIT); 761 if (*swd == NULL) { 762 swcr_freesession(NULL, i); 763 return ENOBUFS; 764 } 765 bzero(*swd, sizeof(struct swcr_data)); 766 767 switch (cri->cri_alg) { 768 case CRYPTO_DES_CBC: 769 txf = &swcr_enc_xform_des; 770 goto enccommon; 771 case CRYPTO_3DES_CBC: 772 txf = &swcr_enc_xform_3des; 773 goto enccommon; 774 case CRYPTO_BLF_CBC: 775 txf = &swcr_enc_xform_blf; 776 goto enccommon; 777 case CRYPTO_CAST_CBC: 778 txf = &swcr_enc_xform_cast5; 779 goto enccommon; 780 case CRYPTO_SKIPJACK_CBC: 781 txf = &swcr_enc_xform_skipjack; 782 goto enccommon; 783 case CRYPTO_RIJNDAEL128_CBC: 784 txf = &swcr_enc_xform_rijndael128; 785 goto enccommon; 786 case CRYPTO_NULL_CBC: 787 txf = &swcr_enc_xform_null; 788 goto enccommon; 789 enccommon: 790 error = txf->setkey(&((*swd)->sw_kschedule), 791 cri->cri_key, cri->cri_klen / 8); 792 if (error) { 793 swcr_freesession(NULL, i); 794 return error; 795 } 796 (*swd)->sw_exf = txf; 797 break; 798 799 case CRYPTO_MD5_HMAC: 800 axf = &swcr_auth_hash_hmac_md5_96; 801 goto authcommon; 802 case CRYPTO_SHA1_HMAC: 803 axf = &swcr_auth_hash_hmac_sha1_96; 804 goto authcommon; 805 case CRYPTO_SHA2_HMAC: 806 if (cri->cri_klen == 256) 807 axf = &swcr_auth_hash_hmac_sha2_256; 808 else if (cri->cri_klen == 384) 809 axf = &swcr_auth_hash_hmac_sha2_384; 810 else if (cri->cri_klen == 512) 811 axf = &swcr_auth_hash_hmac_sha2_512; 812 else { 813 swcr_freesession(NULL, i); 814 return EINVAL; 815 } 816 goto authcommon; 817 case CRYPTO_NULL_HMAC: 818 axf = &swcr_auth_hash_null; 819 goto authcommon; 820 case CRYPTO_RIPEMD160_HMAC: 821 axf = &swcr_auth_hash_hmac_ripemd_160_96; 822 authcommon: 823 (*swd)->sw_ictx = malloc(axf->auth_hash->ctxsize, 824 M_CRYPTO_DATA, M_NOWAIT); 825 if ((*swd)->sw_ictx == NULL) { 826 swcr_freesession(NULL, i); 827 return ENOBUFS; 828 } 829 830 (*swd)->sw_octx = malloc(axf->auth_hash->ctxsize, 831 M_CRYPTO_DATA, M_NOWAIT); 832 if ((*swd)->sw_octx == NULL) { 833 swcr_freesession(NULL, i); 834 return ENOBUFS; 835 } 836 837 for (k = 0; k < cri->cri_klen / 8; k++) 838 cri->cri_key[k] ^= HMAC_IPAD_VAL; 839 840 axf->Init((*swd)->sw_ictx); 841 axf->Update((*swd)->sw_ictx, cri->cri_key, 842 cri->cri_klen / 8); 843 axf->Update((*swd)->sw_ictx, hmac_ipad_buffer, 844 HMAC_BLOCK_LEN - (cri->cri_klen / 8)); 845 846 for (k = 0; k < cri->cri_klen / 8; k++) 847 cri->cri_key[k] ^= (HMAC_IPAD_VAL ^ HMAC_OPAD_VAL); 848 849 axf->Init((*swd)->sw_octx); 850 axf->Update((*swd)->sw_octx, cri->cri_key, 851 cri->cri_klen / 8); 852 axf->Update((*swd)->sw_octx, hmac_opad_buffer, 853 HMAC_BLOCK_LEN - (cri->cri_klen / 8)); 854 855 for (k = 0; k < cri->cri_klen / 8; k++) 856 cri->cri_key[k] ^= HMAC_OPAD_VAL; 857 (*swd)->sw_axf = axf; 858 break; 859 860 case CRYPTO_MD5_KPDK: 861 axf = &swcr_auth_hash_key_md5; 862 goto auth2common; 863 864 case CRYPTO_SHA1_KPDK: 865 axf = &swcr_auth_hash_key_sha1; 866 auth2common: 867 (*swd)->sw_ictx = malloc(axf->auth_hash->ctxsize, 868 M_CRYPTO_DATA, M_NOWAIT); 869 if ((*swd)->sw_ictx == NULL) { 870 swcr_freesession(NULL, i); 871 return ENOBUFS; 872 } 873 874 /* Store the key so we can "append" it to the payload */ 875 (*swd)->sw_octx = malloc(cri->cri_klen / 8, M_CRYPTO_DATA, 876 M_NOWAIT); 877 if ((*swd)->sw_octx == NULL) { 878 swcr_freesession(NULL, i); 879 return ENOBUFS; 880 } 881 882 (*swd)->sw_klen = cri->cri_klen / 8; 883 bcopy(cri->cri_key, (*swd)->sw_octx, cri->cri_klen / 8); 884 axf->Init((*swd)->sw_ictx); 885 axf->Update((*swd)->sw_ictx, cri->cri_key, 886 cri->cri_klen / 8); 887 axf->Final(NULL, (*swd)->sw_ictx); 888 (*swd)->sw_axf = axf; 889 break; 890 891 case CRYPTO_MD5: 892 axf = &swcr_auth_hash_md5; 893 goto auth3common; 894 895 case CRYPTO_SHA1: 896 axf = &swcr_auth_hash_sha1; 897 auth3common: 898 (*swd)->sw_ictx = malloc(axf->auth_hash->ctxsize, 899 M_CRYPTO_DATA, M_NOWAIT); 900 if ((*swd)->sw_ictx == NULL) { 901 swcr_freesession(NULL, i); 902 return ENOBUFS; 903 } 904 905 axf->Init((*swd)->sw_ictx); 906 (*swd)->sw_axf = axf; 907 break; 908 909 case CRYPTO_DEFLATE_COMP: 910 cxf = &swcr_comp_algo_deflate; 911 (*swd)->sw_cxf = cxf; 912 break; 913 default: 914 swcr_freesession(NULL, i); 915 return EINVAL; 916 } 917 918 (*swd)->sw_alg = cri->cri_alg; 919 cri = cri->cri_next; 920 swd = &((*swd)->sw_next); 921 } 922 return 0; 923 } 924 925 /* 926 * Free a session. 927 */ 928 static int 929 swcr_freesession(void *arg, u_int64_t tid) 930 { 931 struct swcr_data *swd; 932 const struct swcr_enc_xform *txf; 933 const struct swcr_auth_hash *axf; 934 const struct swcr_comp_algo *cxf; 935 u_int32_t sid = ((u_int32_t) tid) & 0xffffffff; 936 937 if (sid > swcr_sesnum || swcr_sessions == NULL || 938 swcr_sessions[sid] == NULL) 939 return EINVAL; 940 941 /* Silently accept and return */ 942 if (sid == 0) 943 return 0; 944 945 while ((swd = swcr_sessions[sid]) != NULL) { 946 swcr_sessions[sid] = swd->sw_next; 947 948 switch (swd->sw_alg) { 949 case CRYPTO_DES_CBC: 950 case CRYPTO_3DES_CBC: 951 case CRYPTO_BLF_CBC: 952 case CRYPTO_CAST_CBC: 953 case CRYPTO_SKIPJACK_CBC: 954 case CRYPTO_RIJNDAEL128_CBC: 955 case CRYPTO_NULL_CBC: 956 txf = swd->sw_exf; 957 958 if (swd->sw_kschedule) 959 txf->zerokey(&(swd->sw_kschedule)); 960 break; 961 962 case CRYPTO_MD5_HMAC: 963 case CRYPTO_SHA1_HMAC: 964 case CRYPTO_SHA2_HMAC: 965 case CRYPTO_RIPEMD160_HMAC: 966 case CRYPTO_NULL_HMAC: 967 axf = swd->sw_axf; 968 969 if (swd->sw_ictx) { 970 bzero(swd->sw_ictx, axf->auth_hash->ctxsize); 971 free(swd->sw_ictx, M_CRYPTO_DATA); 972 } 973 if (swd->sw_octx) { 974 bzero(swd->sw_octx, axf->auth_hash->ctxsize); 975 free(swd->sw_octx, M_CRYPTO_DATA); 976 } 977 break; 978 979 case CRYPTO_MD5_KPDK: 980 case CRYPTO_SHA1_KPDK: 981 axf = swd->sw_axf; 982 983 if (swd->sw_ictx) { 984 bzero(swd->sw_ictx, axf->auth_hash->ctxsize); 985 free(swd->sw_ictx, M_CRYPTO_DATA); 986 } 987 if (swd->sw_octx) { 988 bzero(swd->sw_octx, swd->sw_klen); 989 free(swd->sw_octx, M_CRYPTO_DATA); 990 } 991 break; 992 993 case CRYPTO_MD5: 994 case CRYPTO_SHA1: 995 axf = swd->sw_axf; 996 997 if (swd->sw_ictx) 998 free(swd->sw_ictx, M_CRYPTO_DATA); 999 break; 1000 1001 case CRYPTO_DEFLATE_COMP: 1002 cxf = swd->sw_cxf; 1003 break; 1004 } 1005 1006 FREE(swd, M_CRYPTO_DATA); 1007 } 1008 return 0; 1009 } 1010 1011 /* 1012 * Process a software request. 1013 */ 1014 static int 1015 swcr_process(void *arg, struct cryptop *crp, int hint) 1016 { 1017 struct cryptodesc *crd; 1018 struct swcr_data *sw; 1019 u_int32_t lid; 1020 int type; 1021 1022 /* Sanity check */ 1023 if (crp == NULL) 1024 return EINVAL; 1025 1026 if (crp->crp_desc == NULL || crp->crp_buf == NULL) { 1027 crp->crp_etype = EINVAL; 1028 goto done; 1029 } 1030 1031 lid = crp->crp_sid & 0xffffffff; 1032 if (lid >= swcr_sesnum || lid == 0 || swcr_sessions[lid] == NULL) { 1033 crp->crp_etype = ENOENT; 1034 goto done; 1035 } 1036 1037 if (crp->crp_flags & CRYPTO_F_IMBUF) { 1038 type = CRYPTO_BUF_MBUF; 1039 } else if (crp->crp_flags & CRYPTO_F_IOV) { 1040 type = CRYPTO_BUF_IOV; 1041 } else { 1042 type = CRYPTO_BUF_CONTIG; 1043 } 1044 1045 /* Go through crypto descriptors, processing as we go */ 1046 for (crd = crp->crp_desc; crd; crd = crd->crd_next) { 1047 /* 1048 * Find the crypto context. 1049 * 1050 * XXX Note that the logic here prevents us from having 1051 * XXX the same algorithm multiple times in a session 1052 * XXX (or rather, we can but it won't give us the right 1053 * XXX results). To do that, we'd need some way of differentiating 1054 * XXX between the various instances of an algorithm (so we can 1055 * XXX locate the correct crypto context). 1056 */ 1057 for (sw = swcr_sessions[lid]; 1058 sw && sw->sw_alg != crd->crd_alg; 1059 sw = sw->sw_next) 1060 ; 1061 1062 /* No such context ? */ 1063 if (sw == NULL) { 1064 crp->crp_etype = EINVAL; 1065 goto done; 1066 } 1067 1068 switch (sw->sw_alg) { 1069 case CRYPTO_DES_CBC: 1070 case CRYPTO_3DES_CBC: 1071 case CRYPTO_BLF_CBC: 1072 case CRYPTO_CAST_CBC: 1073 case CRYPTO_SKIPJACK_CBC: 1074 case CRYPTO_RIJNDAEL128_CBC: 1075 if ((crp->crp_etype = swcr_encdec(crd, sw, 1076 crp->crp_buf, type)) != 0) 1077 goto done; 1078 break; 1079 case CRYPTO_NULL_CBC: 1080 crp->crp_etype = 0; 1081 break; 1082 case CRYPTO_MD5_HMAC: 1083 case CRYPTO_SHA1_HMAC: 1084 case CRYPTO_SHA2_HMAC: 1085 case CRYPTO_RIPEMD160_HMAC: 1086 case CRYPTO_NULL_HMAC: 1087 case CRYPTO_MD5_KPDK: 1088 case CRYPTO_SHA1_KPDK: 1089 case CRYPTO_MD5: 1090 case CRYPTO_SHA1: 1091 if ((crp->crp_etype = swcr_authcompute(crp, crd, sw, 1092 crp->crp_buf, type)) != 0) 1093 goto done; 1094 break; 1095 1096 case CRYPTO_DEFLATE_COMP: 1097 if ((crp->crp_etype = swcr_compdec(crd, sw, 1098 crp->crp_buf, type)) != 0) 1099 goto done; 1100 else 1101 crp->crp_olen = (int)sw->sw_size; 1102 break; 1103 1104 default: 1105 /* Unknown/unsupported algorithm */ 1106 crp->crp_etype = EINVAL; 1107 goto done; 1108 } 1109 } 1110 1111 done: 1112 crypto_done(crp); 1113 return 0; 1114 } 1115 1116 static void 1117 swcr_init(void) 1118 { 1119 swcr_id = crypto_get_driverid(CRYPTOCAP_F_SOFTWARE); 1120 if (swcr_id < 0) { 1121 /* This should never happen */ 1122 panic("Software crypto device cannot initialize!"); 1123 } 1124 1125 crypto_register(swcr_id, CRYPTO_DES_CBC, 1126 0, 0, swcr_newsession, swcr_freesession, swcr_process, NULL); 1127 #define REGISTER(alg) \ 1128 crypto_register(swcr_id, alg, 0, 0, NULL, NULL, NULL, NULL) 1129 1130 REGISTER(CRYPTO_3DES_CBC); 1131 REGISTER(CRYPTO_BLF_CBC); 1132 REGISTER(CRYPTO_CAST_CBC); 1133 REGISTER(CRYPTO_SKIPJACK_CBC); 1134 REGISTER(CRYPTO_NULL_CBC); 1135 REGISTER(CRYPTO_MD5_HMAC); 1136 REGISTER(CRYPTO_SHA1_HMAC); 1137 REGISTER(CRYPTO_SHA2_HMAC); 1138 REGISTER(CRYPTO_RIPEMD160_HMAC); 1139 REGISTER(CRYPTO_NULL_HMAC); 1140 REGISTER(CRYPTO_MD5_KPDK); 1141 REGISTER(CRYPTO_SHA1_KPDK); 1142 REGISTER(CRYPTO_MD5); 1143 REGISTER(CRYPTO_SHA1); 1144 REGISTER(CRYPTO_RIJNDAEL128_CBC); 1145 REGISTER(CRYPTO_DEFLATE_COMP); 1146 #undef REGISTER 1147 } 1148 1149 #ifdef __FreeBSD__ 1150 SYSINIT(cryptosoft_init, SI_SUB_PSEUDO, SI_ORDER_ANY, swcr_init, NULL) 1151 #endif 1152 1153 #ifdef __NetBSD__ 1154 /* 1155 * Pseudo-device init routine for software crypto. 1156 */ 1157 void swcryptoattach(int); 1158 1159 void 1160 swcryptoattach(int num) 1161 { 1162 1163 swcr_init(); 1164 } 1165 #endif /* __NetBSD__ */ 1166
Indexes created Mon Sep 22 13:09:51 GMT 2025