cryptosoft.c revision 1.17
1 /* $NetBSD: cryptosoft.c,v 1.17 2007/03/04 06:03:40 christos Exp $ */ 2 /* $FreeBSD: src/sys/opencrypto/cryptosoft.c,v 1.2.2.1 2002/11/21 23:34:23 sam Exp $ */ 3 /* $OpenBSD: cryptosoft.c,v 1.35 2002/04/26 08:43:50 deraadt Exp $ */ 4 5 /* 6 * The author of this code is Angelos D. Keromytis (angelos (at) cis.upenn.edu) 7 * 8 * This code was written by Angelos D. Keromytis in Athens, Greece, in 9 * February 2000. Network Security Technologies Inc. (NSTI) kindly 10 * supported the development of this code. 11 * 12 * Copyright (c) 2000, 2001 Angelos D. Keromytis 13 * 14 * Permission to use, copy, and modify this software with or without fee 15 * is hereby granted, provided that this entire notice is included in 16 * all source code copies of any software which is or includes a copy or 17 * modification of this software. 18 * 19 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 20 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 21 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 22 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 23 * PURPOSE. 24 */ 25 26 #include <sys/cdefs.h> 27 __KERNEL_RCSID(0, "$NetBSD: cryptosoft.c,v 1.17 2007/03/04 06:03:40 christos Exp $"); 28 29 #include <sys/param.h> 30 #include <sys/systm.h> 31 #include <sys/malloc.h> 32 #include <sys/mbuf.h> 33 #include <sys/sysctl.h> 34 #include <sys/errno.h> 35 36 #include <opencrypto/cryptodev.h> 37 #include <opencrypto/cryptosoft.h> 38 #include <opencrypto/xform.h> 39 40 #include <opencrypto/cryptosoft_xform.c> 41 42 union authctx { 43 MD5_CTX md5ctx; 44 SHA1_CTX sha1ctx; 45 RMD160_CTX rmd160ctx; 46 SHA256_CTX sha256ctx; 47 SHA384_CTX sha384ctx; 48 SHA512_CTX sha512ctx; 49 }; 50 51 struct swcr_data **swcr_sessions = NULL; 52 u_int32_t swcr_sesnum = 0; 53 int32_t swcr_id = -1; 54 55 #define COPYBACK(x, a, b, c, d) \ 56 (x) == CRYPTO_BUF_MBUF ? m_copyback((struct mbuf *)a,b,c,d) \ 57 : cuio_copyback((struct uio *)a,b,c,d) 58 #define COPYDATA(x, a, b, c, d) \ 59 (x) == CRYPTO_BUF_MBUF ? m_copydata((struct mbuf *)a,b,c,d) \ 60 : cuio_copydata((struct uio *)a,b,c,d) 61 62 static int swcr_encdec(struct cryptodesc *, struct swcr_data *, void *, int); 63 static int swcr_compdec(struct cryptodesc *, struct swcr_data *, void *, int); 64 static int swcr_process(void *, struct cryptop *, int); 65 static int swcr_newsession(void *, u_int32_t *, struct cryptoini *); 66 static int swcr_freesession(void *, u_int64_t); 67 68 /* 69 * Apply a symmetric encryption/decryption algorithm. 70 */ 71 static int 72 swcr_encdec(struct cryptodesc *crd, struct swcr_data *sw, void *bufv, 73 int outtype) 74 { 75 char *buf = bufv; 76 unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN], *idat; 77 unsigned char *ivp, piv[EALG_MAX_BLOCK_LEN]; 78 const struct swcr_enc_xform *exf; 79 int i, k, j, blks; 80 int count, ind; 81 82 exf = sw->sw_exf; 83 blks = exf->enc_xform->blocksize; 84 85 /* Check for non-padded data */ 86 if (crd->crd_len % blks) 87 return EINVAL; 88 89 /* Initialize the IV */ 90 if (crd->crd_flags & CRD_F_ENCRYPT) { 91 /* IV explicitly provided ? */ 92 if (crd->crd_flags & CRD_F_IV_EXPLICIT) 93 bcopy(crd->crd_iv, iv, blks); 94 else { 95 /* Get random IV */ 96 for (i = 0; 97 i + sizeof (u_int32_t) < EALG_MAX_BLOCK_LEN; 98 i += sizeof (u_int32_t)) { 99 u_int32_t temp = arc4random(); 100 101 bcopy(&temp, iv + i, sizeof(u_int32_t)); 102 } 103 /* 104 * What if the block size is not a multiple 105 * of sizeof (u_int32_t), which is the size of 106 * what arc4random() returns ? 107 */ 108 if (EALG_MAX_BLOCK_LEN % sizeof (u_int32_t) != 0) { 109 u_int32_t temp = arc4random(); 110 111 bcopy (&temp, iv + i, 112 EALG_MAX_BLOCK_LEN - i); 113 } 114 } 115 116 /* Do we need to write the IV */ 117 if (!(crd->crd_flags & CRD_F_IV_PRESENT)) { 118 COPYBACK(outtype, buf, crd->crd_inject, blks, iv); 119 } 120 121 } else { /* Decryption */ 122 /* IV explicitly provided ? */ 123 if (crd->crd_flags & CRD_F_IV_EXPLICIT) 124 bcopy(crd->crd_iv, iv, blks); 125 else { 126 /* Get IV off buf */ 127 COPYDATA(outtype, buf, crd->crd_inject, blks, iv); 128 } 129 } 130 131 ivp = iv; 132 133 if (outtype == CRYPTO_BUF_CONTIG) { 134 if (crd->crd_flags & CRD_F_ENCRYPT) { 135 for (i = crd->crd_skip; 136 i < crd->crd_skip + crd->crd_len; i += blks) { 137 /* XOR with the IV/previous block, as appropriate. */ 138 if (i == crd->crd_skip) 139 for (k = 0; k < blks; k++) 140 buf[i + k] ^= ivp[k]; 141 else 142 for (k = 0; k < blks; k++) 143 buf[i + k] ^= buf[i + k - blks]; 144 exf->encrypt(sw->sw_kschedule, buf + i); 145 } 146 } else { /* Decrypt */ 147 /* 148 * Start at the end, so we don't need to keep the encrypted 149 * block as the IV for the next block. 150 */ 151 for (i = crd->crd_skip + crd->crd_len - blks; 152 i >= crd->crd_skip; i -= blks) { 153 exf->decrypt(sw->sw_kschedule, buf + i); 154 155 /* XOR with the IV/previous block, as appropriate */ 156 if (i == crd->crd_skip) 157 for (k = 0; k < blks; k++) 158 buf[i + k] ^= ivp[k]; 159 else 160 for (k = 0; k < blks; k++) 161 buf[i + k] ^= buf[i + k - blks]; 162 } 163 } 164 165 return 0; 166 } else if (outtype == CRYPTO_BUF_MBUF) { 167 struct mbuf *m = (struct mbuf *) buf; 168 169 /* Find beginning of data */ 170 m = m_getptr(m, crd->crd_skip, &k); 171 if (m == NULL) 172 return EINVAL; 173 174 i = crd->crd_len; 175 176 while (i > 0) { 177 /* 178 * If there's insufficient data at the end of 179 * an mbuf, we have to do some copying. 180 */ 181 if (m->m_len < k + blks && m->m_len != k) { 182 m_copydata(m, k, blks, blk); 183 184 /* Actual encryption/decryption */ 185 if (crd->crd_flags & CRD_F_ENCRYPT) { 186 /* XOR with previous block */ 187 for (j = 0; j < blks; j++) 188 blk[j] ^= ivp[j]; 189 190 exf->encrypt(sw->sw_kschedule, blk); 191 192 /* 193 * Keep encrypted block for XOR'ing 194 * with next block 195 */ 196 bcopy(blk, iv, blks); 197 ivp = iv; 198 } else { /* decrypt */ 199 /* 200 * Keep encrypted block for XOR'ing 201 * with next block 202 */ 203 if (ivp == iv) 204 bcopy(blk, piv, blks); 205 else 206 bcopy(blk, iv, blks); 207 208 exf->decrypt(sw->sw_kschedule, blk); 209 210 /* XOR with previous block */ 211 for (j = 0; j < blks; j++) 212 blk[j] ^= ivp[j]; 213 214 if (ivp == iv) 215 bcopy(piv, iv, blks); 216 else 217 ivp = iv; 218 } 219 220 /* Copy back decrypted block */ 221 m_copyback(m, k, blks, blk); 222 223 /* Advance pointer */ 224 m = m_getptr(m, k + blks, &k); 225 if (m == NULL) 226 return EINVAL; 227 228 i -= blks; 229 230 /* Could be done... */ 231 if (i == 0) 232 break; 233 } 234 235 /* Skip possibly empty mbufs */ 236 if (k == m->m_len) { 237 for (m = m->m_next; m && m->m_len == 0; 238 m = m->m_next) 239 ; 240 k = 0; 241 } 242 243 /* Sanity check */ 244 if (m == NULL) 245 return EINVAL; 246 247 /* 248 * Warning: idat may point to garbage here, but 249 * we only use it in the while() loop, only if 250 * there are indeed enough data. 251 */ 252 idat = mtod(m, unsigned char *) + k; 253 254 while (m->m_len >= k + blks && i > 0) { 255 if (crd->crd_flags & CRD_F_ENCRYPT) { 256 /* XOR with previous block/IV */ 257 for (j = 0; j < blks; j++) 258 idat[j] ^= ivp[j]; 259 260 exf->encrypt(sw->sw_kschedule, idat); 261 ivp = idat; 262 } else { /* decrypt */ 263 /* 264 * Keep encrypted block to be used 265 * in next block's processing. 266 */ 267 if (ivp == iv) 268 bcopy(idat, piv, blks); 269 else 270 bcopy(idat, iv, blks); 271 272 exf->decrypt(sw->sw_kschedule, idat); 273 274 /* XOR with previous block/IV */ 275 for (j = 0; j < blks; j++) 276 idat[j] ^= ivp[j]; 277 278 if (ivp == iv) 279 bcopy(piv, iv, blks); 280 else 281 ivp = iv; 282 } 283 284 idat += blks; 285 k += blks; 286 i -= blks; 287 } 288 } 289 290 return 0; /* Done with mbuf encryption/decryption */ 291 } else if (outtype == CRYPTO_BUF_IOV) { 292 struct uio *uio = (struct uio *) buf; 293 294 #ifdef __FreeBSD__ 295 struct iovec *iov; 296 /* Find beginning of data */ 297 iov = cuio_getptr(uio, crd->crd_skip, &k); 298 if (iov == NULL) 299 return EINVAL; 300 301 i = crd->crd_len; 302 303 while (i > 0) { 304 /* 305 * If there's insufficient data at the end of 306 * an iovec, we have to do some copying. 307 */ 308 if (iov->iov_len < k + blks && iov->iov_len != k) { 309 cuio_copydata(uio, k, blks, blk); 310 311 /* Actual encryption/decryption */ 312 if (crd->crd_flags & CRD_F_ENCRYPT) { 313 /* XOR with previous block */ 314 for (j = 0; j < blks; j++) 315 blk[j] ^= ivp[j]; 316 317 exf->encrypt(sw->sw_kschedule, blk); 318 319 /* 320 * Keep encrypted block for XOR'ing 321 * with next block 322 */ 323 bcopy(blk, iv, blks); 324 ivp = iv; 325 } else { /* decrypt */ 326 /* 327 * Keep encrypted block for XOR'ing 328 * with next block 329 */ 330 if (ivp == iv) 331 bcopy(blk, piv, blks); 332 else 333 bcopy(blk, iv, blks); 334 335 exf->decrypt(sw->sw_kschedule, blk); 336 337 /* XOR with previous block */ 338 for (j = 0; j < blks; j++) 339 blk[j] ^= ivp[j]; 340 341 if (ivp == iv) 342 bcopy(piv, iv, blks); 343 else 344 ivp = iv; 345 } 346 347 /* Copy back decrypted block */ 348 cuio_copyback(uio, k, blks, blk); 349 350 /* Advance pointer */ 351 iov = cuio_getptr(uio, k + blks, &k); 352 if (iov == NULL) 353 return EINVAL; 354 355 i -= blks; 356 357 /* Could be done... */ 358 if (i == 0) 359 break; 360 } 361 362 /* 363 * Warning: idat may point to garbage here, but 364 * we only use it in the while() loop, only if 365 * there are indeed enough data. 366 */ 367 idat = (char *)iov->iov_base + k; 368 369 while (iov->iov_len >= k + blks && i > 0) { 370 if (crd->crd_flags & CRD_F_ENCRYPT) { 371 /* XOR with previous block/IV */ 372 for (j = 0; j < blks; j++) 373 idat[j] ^= ivp[j]; 374 375 exf->encrypt(sw->sw_kschedule, idat); 376 ivp = idat; 377 } else { /* decrypt */ 378 /* 379 * Keep encrypted block to be used 380 * in next block's processing. 381 */ 382 if (ivp == iv) 383 bcopy(idat, piv, blks); 384 else 385 bcopy(idat, iv, blks); 386 387 exf->decrypt(sw->sw_kschedule, idat); 388 389 /* XOR with previous block/IV */ 390 for (j = 0; j < blks; j++) 391 idat[j] ^= ivp[j]; 392 393 if (ivp == iv) 394 bcopy(piv, iv, blks); 395 else 396 ivp = iv; 397 } 398 399 idat += blks; 400 k += blks; 401 i -= blks; 402 } 403 } 404 405 return 0; /* Done with mbuf encryption/decryption */ 406 #else /* !freebsd iov */ 407 /* Find beginning of data */ 408 count = crd->crd_skip; 409 ind = cuio_getptr(uio, count, &k); 410 if (ind == -1) 411 return EINVAL; 412 413 i = crd->crd_len; 414 415 while (i > 0) { 416 /* 417 * If there's insufficient data at the end, 418 * we have to do some copying. 419 */ 420 if (uio->uio_iov[ind].iov_len < k + blks && 421 uio->uio_iov[ind].iov_len != k) { 422 cuio_copydata(uio, k, blks, blk); 423 424 /* Actual encryption/decryption */ 425 if (crd->crd_flags & CRD_F_ENCRYPT) { 426 /* XOR with previous block */ 427 for (j = 0; j < blks; j++) 428 blk[j] ^= ivp[j]; 429 430 exf->encrypt(sw->sw_kschedule, blk); 431 432 /* 433 * Keep encrypted block for XOR'ing 434 * with next block 435 */ 436 bcopy(blk, iv, blks); 437 ivp = iv; 438 } else { /* decrypt */ 439 /* 440 * Keep encrypted block for XOR'ing 441 * with next block 442 */ 443 if (ivp == iv) 444 bcopy(blk, piv, blks); 445 else 446 bcopy(blk, iv, blks); 447 448 exf->decrypt(sw->sw_kschedule, blk); 449 450 /* XOR with previous block */ 451 for (j = 0; j < blks; j++) 452 blk[j] ^= ivp[j]; 453 454 if (ivp == iv) 455 bcopy(piv, iv, blks); 456 else 457 ivp = iv; 458 } 459 460 /* Copy back decrypted block */ 461 cuio_copyback(uio, k, blks, blk); 462 463 count += blks; 464 465 /* Advance pointer */ 466 ind = cuio_getptr(uio, count, &k); 467 if (ind == -1) 468 return (EINVAL); 469 470 i -= blks; 471 472 /* Could be done... */ 473 if (i == 0) 474 break; 475 } 476 477 /* 478 * Warning: idat may point to garbage here, but 479 * we only use it in the while() loop, only if 480 * there are indeed enough data. 481 */ 482 idat = ((char *)uio->uio_iov[ind].iov_base) + k; 483 484 while (uio->uio_iov[ind].iov_len >= k + blks && 485 i > 0) { 486 if (crd->crd_flags & CRD_F_ENCRYPT) { 487 /* XOR with previous block/IV */ 488 for (j = 0; j < blks; j++) 489 idat[j] ^= ivp[j]; 490 491 exf->encrypt(sw->sw_kschedule, idat); 492 ivp = idat; 493 } else { /* decrypt */ 494 /* 495 * Keep encrypted block to be used 496 * in next block's processing. 497 */ 498 if (ivp == iv) 499 bcopy(idat, piv, blks); 500 else 501 bcopy(idat, iv, blks); 502 503 exf->decrypt(sw->sw_kschedule, idat); 504 505 /* XOR with previous block/IV */ 506 for (j = 0; j < blks; j++) 507 idat[j] ^= ivp[j]; 508 509 if (ivp == iv) 510 bcopy(piv, iv, blks); 511 else 512 ivp = iv; 513 } 514 515 idat += blks; 516 count += blks; 517 k += blks; 518 i -= blks; 519 } 520 } 521 #endif 522 return 0; /* Done with mbuf encryption/decryption */ 523 } 524 525 /* Unreachable */ 526 return EINVAL; 527 } 528 529 /* 530 * Compute keyed-hash authenticator. 531 */ 532 int 533 swcr_authcompute(struct cryptop *crp, struct cryptodesc *crd, 534 struct swcr_data *sw, void *buf, int outtype) 535 { 536 unsigned char aalg[AALG_MAX_RESULT_LEN]; 537 const struct swcr_auth_hash *axf; 538 union authctx ctx; 539 int err; 540 541 if (sw->sw_ictx == 0) 542 return EINVAL; 543 544 axf = sw->sw_axf; 545 546 bcopy(sw->sw_ictx, &ctx, axf->auth_hash->ctxsize); 547 548 switch (outtype) { 549 case CRYPTO_BUF_CONTIG: 550 axf->Update(&ctx, (char *)buf + crd->crd_skip, crd->crd_len); 551 break; 552 case CRYPTO_BUF_MBUF: 553 err = m_apply((struct mbuf *) buf, crd->crd_skip, crd->crd_len, 554 (int (*)(void*, void *, unsigned int)) axf->Update, 555 (void *) &ctx); 556 if (err) 557 return err; 558 break; 559 case CRYPTO_BUF_IOV: 560 #ifdef __FreeBSD__ 561 /*XXX FIXME: handle iov case*/ 562 return EINVAL; 563 #else 564 err = cuio_apply((struct uio *) buf, crd->crd_skip, 565 crd->crd_len, 566 (int (*)(void *, void *, unsigned int)) axf->Update, 567 (void *) &ctx); 568 if (err) { 569 return err; 570 } 571 #endif 572 break; 573 default: 574 return EINVAL; 575 } 576 577 switch (sw->sw_alg) { 578 case CRYPTO_MD5_HMAC: 579 case CRYPTO_SHA1_HMAC: 580 case CRYPTO_SHA2_HMAC: 581 case CRYPTO_RIPEMD160_HMAC: 582 if (sw->sw_octx == NULL) 583 return EINVAL; 584 585 axf->Final(aalg, &ctx); 586 bcopy(sw->sw_octx, &ctx, axf->auth_hash->ctxsize); 587 axf->Update(&ctx, aalg, axf->auth_hash->hashsize); 588 axf->Final(aalg, &ctx); 589 break; 590 591 case CRYPTO_MD5_KPDK: 592 case CRYPTO_SHA1_KPDK: 593 if (sw->sw_octx == NULL) 594 return EINVAL; 595 596 axf->Update(&ctx, sw->sw_octx, sw->sw_klen); 597 axf->Final(aalg, &ctx); 598 break; 599 600 case CRYPTO_NULL_HMAC: 601 case CRYPTO_MD5: 602 case CRYPTO_SHA1: 603 axf->Final(aalg, &ctx); 604 break; 605 } 606 607 /* Inject the authentication data */ 608 switch (outtype) { 609 case CRYPTO_BUF_CONTIG: 610 (void)memcpy((char *)buf + crd->crd_inject, aalg, 611 axf->auth_hash->authsize); 612 break; 613 case CRYPTO_BUF_MBUF: 614 m_copyback((struct mbuf *) buf, crd->crd_inject, 615 axf->auth_hash->authsize, aalg); 616 break; 617 case CRYPTO_BUF_IOV: 618 bcopy(aalg, crp->crp_mac, axf->auth_hash->authsize); 619 break; 620 default: 621 return EINVAL; 622 } 623 return 0; 624 } 625 626 /* 627 * Apply a compression/decompression algorithm 628 */ 629 static int 630 swcr_compdec(struct cryptodesc *crd, struct swcr_data *sw, 631 void *buf, int outtype) 632 { 633 u_int8_t *data, *out; 634 const struct swcr_comp_algo *cxf; 635 int adj; 636 u_int32_t result; 637 638 cxf = sw->sw_cxf; 639 640 /* We must handle the whole buffer of data in one time 641 * then if there is not all the data in the mbuf, we must 642 * copy in a buffer. 643 */ 644 645 data = malloc(crd->crd_len, M_CRYPTO_DATA, M_NOWAIT); 646 if (data == NULL) 647 return (EINVAL); 648 COPYDATA(outtype, buf, crd->crd_skip, crd->crd_len, data); 649 650 if (crd->crd_flags & CRD_F_COMP) 651 result = cxf->compress(data, crd->crd_len, &out); 652 else 653 result = cxf->decompress(data, crd->crd_len, &out); 654 655 FREE(data, M_CRYPTO_DATA); 656 if (result == 0) 657 return EINVAL; 658 659 /* Copy back the (de)compressed data. m_copyback is 660 * extending the mbuf as necessary. 661 */ 662 sw->sw_size = result; 663 /* Check the compressed size when doing compression */ 664 if (crd->crd_flags & CRD_F_COMP) { 665 if (result > crd->crd_len) { 666 /* Compression was useless, we lost time */ 667 FREE(out, M_CRYPTO_DATA); 668 return 0; 669 } 670 } 671 672 COPYBACK(outtype, buf, crd->crd_skip, result, out); 673 if (result < crd->crd_len) { 674 adj = result - crd->crd_len; 675 if (outtype == CRYPTO_BUF_MBUF) { 676 adj = result - crd->crd_len; 677 m_adj((struct mbuf *)buf, adj); 678 } else { 679 struct uio *uio = (struct uio *)buf; 680 int ind; 681 682 adj = crd->crd_len - result; 683 ind = uio->uio_iovcnt - 1; 684 685 while (adj > 0 && ind >= 0) { 686 if (adj < uio->uio_iov[ind].iov_len) { 687 uio->uio_iov[ind].iov_len -= adj; 688 break; 689 } 690 691 adj -= uio->uio_iov[ind].iov_len; 692 uio->uio_iov[ind].iov_len = 0; 693 ind--; 694 uio->uio_iovcnt--; 695 } 696 } 697 } 698 FREE(out, M_CRYPTO_DATA); 699 return 0; 700 } 701 702 /* 703 * Generate a new software session. 704 */ 705 static int 706 swcr_newsession(void *arg, u_int32_t *sid, struct cryptoini *cri) 707 { 708 struct swcr_data **swd; 709 const struct swcr_auth_hash *axf; 710 const struct swcr_enc_xform *txf; 711 const struct swcr_comp_algo *cxf; 712 u_int32_t i; 713 int k, error; 714 715 if (sid == NULL || cri == NULL) 716 return EINVAL; 717 718 if (swcr_sessions) { 719 for (i = 1; i < swcr_sesnum; i++) 720 if (swcr_sessions[i] == NULL) 721 break; 722 } else 723 i = 1; /* NB: to silence compiler warning */ 724 725 if (swcr_sessions == NULL || i == swcr_sesnum) { 726 if (swcr_sessions == NULL) { 727 i = 1; /* We leave swcr_sessions[0] empty */ 728 swcr_sesnum = CRYPTO_SW_SESSIONS; 729 } else 730 swcr_sesnum *= 2; 731 732 swd = malloc(swcr_sesnum * sizeof(struct swcr_data *), 733 M_CRYPTO_DATA, M_NOWAIT); 734 if (swd == NULL) { 735 /* Reset session number */ 736 if (swcr_sesnum == CRYPTO_SW_SESSIONS) 737 swcr_sesnum = 0; 738 else 739 swcr_sesnum /= 2; 740 return ENOBUFS; 741 } 742 743 bzero(swd, swcr_sesnum * sizeof(struct swcr_data *)); 744 745 /* Copy existing sessions */ 746 if (swcr_sessions) { 747 bcopy(swcr_sessions, swd, 748 (swcr_sesnum / 2) * sizeof(struct swcr_data *)); 749 free(swcr_sessions, M_CRYPTO_DATA); 750 } 751 752 swcr_sessions = swd; 753 } 754 755 swd = &swcr_sessions[i]; 756 *sid = i; 757 758 while (cri) { 759 *swd = malloc(sizeof **swd, M_CRYPTO_DATA, M_NOWAIT); 760 if (*swd == NULL) { 761 swcr_freesession(NULL, i); 762 return ENOBUFS; 763 } 764 bzero(*swd, sizeof(struct swcr_data)); 765 766 switch (cri->cri_alg) { 767 case CRYPTO_DES_CBC: 768 txf = &swcr_enc_xform_des; 769 goto enccommon; 770 case CRYPTO_3DES_CBC: 771 txf = &swcr_enc_xform_3des; 772 goto enccommon; 773 case CRYPTO_BLF_CBC: 774 txf = &swcr_enc_xform_blf; 775 goto enccommon; 776 case CRYPTO_CAST_CBC: 777 txf = &swcr_enc_xform_cast5; 778 goto enccommon; 779 case CRYPTO_SKIPJACK_CBC: 780 txf = &swcr_enc_xform_skipjack; 781 goto enccommon; 782 case CRYPTO_RIJNDAEL128_CBC: 783 txf = &swcr_enc_xform_rijndael128; 784 goto enccommon; 785 case CRYPTO_NULL_CBC: 786 txf = &swcr_enc_xform_null; 787 goto enccommon; 788 enccommon: 789 error = txf->setkey(&((*swd)->sw_kschedule), 790 cri->cri_key, cri->cri_klen / 8); 791 if (error) { 792 swcr_freesession(NULL, i); 793 return error; 794 } 795 (*swd)->sw_exf = txf; 796 break; 797 798 case CRYPTO_MD5_HMAC: 799 axf = &swcr_auth_hash_hmac_md5_96; 800 goto authcommon; 801 case CRYPTO_SHA1_HMAC: 802 axf = &swcr_auth_hash_hmac_sha1_96; 803 goto authcommon; 804 case CRYPTO_SHA2_HMAC: 805 if (cri->cri_klen == 256) 806 axf = &swcr_auth_hash_hmac_sha2_256; 807 else if (cri->cri_klen == 384) 808 axf = &swcr_auth_hash_hmac_sha2_384; 809 else if (cri->cri_klen == 512) 810 axf = &swcr_auth_hash_hmac_sha2_512; 811 else { 812 swcr_freesession(NULL, i); 813 return EINVAL; 814 } 815 goto authcommon; 816 case CRYPTO_NULL_HMAC: 817 axf = &swcr_auth_hash_null; 818 goto authcommon; 819 case CRYPTO_RIPEMD160_HMAC: 820 axf = &swcr_auth_hash_hmac_ripemd_160_96; 821 authcommon: 822 (*swd)->sw_ictx = malloc(axf->auth_hash->ctxsize, 823 M_CRYPTO_DATA, M_NOWAIT); 824 if ((*swd)->sw_ictx == NULL) { 825 swcr_freesession(NULL, i); 826 return ENOBUFS; 827 } 828 829 (*swd)->sw_octx = malloc(axf->auth_hash->ctxsize, 830 M_CRYPTO_DATA, M_NOWAIT); 831 if ((*swd)->sw_octx == NULL) { 832 swcr_freesession(NULL, i); 833 return ENOBUFS; 834 } 835 836 for (k = 0; k < cri->cri_klen / 8; k++) 837 cri->cri_key[k] ^= HMAC_IPAD_VAL; 838 839 axf->Init((*swd)->sw_ictx); 840 axf->Update((*swd)->sw_ictx, cri->cri_key, 841 cri->cri_klen / 8); 842 axf->Update((*swd)->sw_ictx, hmac_ipad_buffer, 843 HMAC_BLOCK_LEN - (cri->cri_klen / 8)); 844 845 for (k = 0; k < cri->cri_klen / 8; k++) 846 cri->cri_key[k] ^= (HMAC_IPAD_VAL ^ HMAC_OPAD_VAL); 847 848 axf->Init((*swd)->sw_octx); 849 axf->Update((*swd)->sw_octx, cri->cri_key, 850 cri->cri_klen / 8); 851 axf->Update((*swd)->sw_octx, hmac_opad_buffer, 852 HMAC_BLOCK_LEN - (cri->cri_klen / 8)); 853 854 for (k = 0; k < cri->cri_klen / 8; k++) 855 cri->cri_key[k] ^= HMAC_OPAD_VAL; 856 (*swd)->sw_axf = axf; 857 break; 858 859 case CRYPTO_MD5_KPDK: 860 axf = &swcr_auth_hash_key_md5; 861 goto auth2common; 862 863 case CRYPTO_SHA1_KPDK: 864 axf = &swcr_auth_hash_key_sha1; 865 auth2common: 866 (*swd)->sw_ictx = malloc(axf->auth_hash->ctxsize, 867 M_CRYPTO_DATA, M_NOWAIT); 868 if ((*swd)->sw_ictx == NULL) { 869 swcr_freesession(NULL, i); 870 return ENOBUFS; 871 } 872 873 /* Store the key so we can "append" it to the payload */ 874 (*swd)->sw_octx = malloc(cri->cri_klen / 8, M_CRYPTO_DATA, 875 M_NOWAIT); 876 if ((*swd)->sw_octx == NULL) { 877 swcr_freesession(NULL, i); 878 return ENOBUFS; 879 } 880 881 (*swd)->sw_klen = cri->cri_klen / 8; 882 bcopy(cri->cri_key, (*swd)->sw_octx, cri->cri_klen / 8); 883 axf->Init((*swd)->sw_ictx); 884 axf->Update((*swd)->sw_ictx, cri->cri_key, 885 cri->cri_klen / 8); 886 axf->Final(NULL, (*swd)->sw_ictx); 887 (*swd)->sw_axf = axf; 888 break; 889 890 case CRYPTO_MD5: 891 axf = &swcr_auth_hash_md5; 892 goto auth3common; 893 894 case CRYPTO_SHA1: 895 axf = &swcr_auth_hash_sha1; 896 auth3common: 897 (*swd)->sw_ictx = malloc(axf->auth_hash->ctxsize, 898 M_CRYPTO_DATA, M_NOWAIT); 899 if ((*swd)->sw_ictx == NULL) { 900 swcr_freesession(NULL, i); 901 return ENOBUFS; 902 } 903 904 axf->Init((*swd)->sw_ictx); 905 (*swd)->sw_axf = axf; 906 break; 907 908 case CRYPTO_DEFLATE_COMP: 909 cxf = &swcr_comp_algo_deflate; 910 (*swd)->sw_cxf = cxf; 911 break; 912 default: 913 swcr_freesession(NULL, i); 914 return EINVAL; 915 } 916 917 (*swd)->sw_alg = cri->cri_alg; 918 cri = cri->cri_next; 919 swd = &((*swd)->sw_next); 920 } 921 return 0; 922 } 923 924 /* 925 * Free a session. 926 */ 927 static int 928 swcr_freesession(void *arg, u_int64_t tid) 929 { 930 struct swcr_data *swd; 931 const struct swcr_enc_xform *txf; 932 const struct swcr_auth_hash *axf; 933 const struct swcr_comp_algo *cxf; 934 u_int32_t sid = ((u_int32_t) tid) & 0xffffffff; 935 936 if (sid > swcr_sesnum || swcr_sessions == NULL || 937 swcr_sessions[sid] == NULL) 938 return EINVAL; 939 940 /* Silently accept and return */ 941 if (sid == 0) 942 return 0; 943 944 while ((swd = swcr_sessions[sid]) != NULL) { 945 swcr_sessions[sid] = swd->sw_next; 946 947 switch (swd->sw_alg) { 948 case CRYPTO_DES_CBC: 949 case CRYPTO_3DES_CBC: 950 case CRYPTO_BLF_CBC: 951 case CRYPTO_CAST_CBC: 952 case CRYPTO_SKIPJACK_CBC: 953 case CRYPTO_RIJNDAEL128_CBC: 954 case CRYPTO_NULL_CBC: 955 txf = swd->sw_exf; 956 957 if (swd->sw_kschedule) 958 txf->zerokey(&(swd->sw_kschedule)); 959 break; 960 961 case CRYPTO_MD5_HMAC: 962 case CRYPTO_SHA1_HMAC: 963 case CRYPTO_SHA2_HMAC: 964 case CRYPTO_RIPEMD160_HMAC: 965 case CRYPTO_NULL_HMAC: 966 axf = swd->sw_axf; 967 968 if (swd->sw_ictx) { 969 bzero(swd->sw_ictx, axf->auth_hash->ctxsize); 970 free(swd->sw_ictx, M_CRYPTO_DATA); 971 } 972 if (swd->sw_octx) { 973 bzero(swd->sw_octx, axf->auth_hash->ctxsize); 974 free(swd->sw_octx, M_CRYPTO_DATA); 975 } 976 break; 977 978 case CRYPTO_MD5_KPDK: 979 case CRYPTO_SHA1_KPDK: 980 axf = swd->sw_axf; 981 982 if (swd->sw_ictx) { 983 bzero(swd->sw_ictx, axf->auth_hash->ctxsize); 984 free(swd->sw_ictx, M_CRYPTO_DATA); 985 } 986 if (swd->sw_octx) { 987 bzero(swd->sw_octx, swd->sw_klen); 988 free(swd->sw_octx, M_CRYPTO_DATA); 989 } 990 break; 991 992 case CRYPTO_MD5: 993 case CRYPTO_SHA1: 994 axf = swd->sw_axf; 995 996 if (swd->sw_ictx) 997 free(swd->sw_ictx, M_CRYPTO_DATA); 998 break; 999 1000 case CRYPTO_DEFLATE_COMP: 1001 cxf = swd->sw_cxf; 1002 break; 1003 } 1004 1005 FREE(swd, M_CRYPTO_DATA); 1006 } 1007 return 0; 1008 } 1009 1010 /* 1011 * Process a software request. 1012 */ 1013 static int 1014 swcr_process(void *arg, struct cryptop *crp, int hint) 1015 { 1016 struct cryptodesc *crd; 1017 struct swcr_data *sw; 1018 u_int32_t lid; 1019 int type; 1020 1021 /* Sanity check */ 1022 if (crp == NULL) 1023 return EINVAL; 1024 1025 if (crp->crp_desc == NULL || crp->crp_buf == NULL) { 1026 crp->crp_etype = EINVAL; 1027 goto done; 1028 } 1029 1030 lid = crp->crp_sid & 0xffffffff; 1031 if (lid >= swcr_sesnum || lid == 0 || swcr_sessions[lid] == NULL) { 1032 crp->crp_etype = ENOENT; 1033 goto done; 1034 } 1035 1036 if (crp->crp_flags & CRYPTO_F_IMBUF) { 1037 type = CRYPTO_BUF_MBUF; 1038 } else if (crp->crp_flags & CRYPTO_F_IOV) { 1039 type = CRYPTO_BUF_IOV; 1040 } else { 1041 type = CRYPTO_BUF_CONTIG; 1042 } 1043 1044 /* Go through crypto descriptors, processing as we go */ 1045 for (crd = crp->crp_desc; crd; crd = crd->crd_next) { 1046 /* 1047 * Find the crypto context. 1048 * 1049 * XXX Note that the logic here prevents us from having 1050 * XXX the same algorithm multiple times in a session 1051 * XXX (or rather, we can but it won't give us the right 1052 * XXX results). To do that, we'd need some way of differentiating 1053 * XXX between the various instances of an algorithm (so we can 1054 * XXX locate the correct crypto context). 1055 */ 1056 for (sw = swcr_sessions[lid]; 1057 sw && sw->sw_alg != crd->crd_alg; 1058 sw = sw->sw_next) 1059 ; 1060 1061 /* No such context ? */ 1062 if (sw == NULL) { 1063 crp->crp_etype = EINVAL; 1064 goto done; 1065 } 1066 1067 switch (sw->sw_alg) { 1068 case CRYPTO_DES_CBC: 1069 case CRYPTO_3DES_CBC: 1070 case CRYPTO_BLF_CBC: 1071 case CRYPTO_CAST_CBC: 1072 case CRYPTO_SKIPJACK_CBC: 1073 case CRYPTO_RIJNDAEL128_CBC: 1074 if ((crp->crp_etype = swcr_encdec(crd, sw, 1075 crp->crp_buf, type)) != 0) 1076 goto done; 1077 break; 1078 case CRYPTO_NULL_CBC: 1079 crp->crp_etype = 0; 1080 break; 1081 case CRYPTO_MD5_HMAC: 1082 case CRYPTO_SHA1_HMAC: 1083 case CRYPTO_SHA2_HMAC: 1084 case CRYPTO_RIPEMD160_HMAC: 1085 case CRYPTO_NULL_HMAC: 1086 case CRYPTO_MD5_KPDK: 1087 case CRYPTO_SHA1_KPDK: 1088 case CRYPTO_MD5: 1089 case CRYPTO_SHA1: 1090 if ((crp->crp_etype = swcr_authcompute(crp, crd, sw, 1091 crp->crp_buf, type)) != 0) 1092 goto done; 1093 break; 1094 1095 case CRYPTO_DEFLATE_COMP: 1096 if ((crp->crp_etype = swcr_compdec(crd, sw, 1097 crp->crp_buf, type)) != 0) 1098 goto done; 1099 else 1100 crp->crp_olen = (int)sw->sw_size; 1101 break; 1102 1103 default: 1104 /* Unknown/unsupported algorithm */ 1105 crp->crp_etype = EINVAL; 1106 goto done; 1107 } 1108 } 1109 1110 done: 1111 crypto_done(crp); 1112 return 0; 1113 } 1114 1115 static void 1116 swcr_init(void) 1117 { 1118 swcr_id = crypto_get_driverid(CRYPTOCAP_F_SOFTWARE); 1119 if (swcr_id < 0) { 1120 /* This should never happen */ 1121 panic("Software crypto device cannot initialize!"); 1122 } 1123 1124 crypto_register(swcr_id, CRYPTO_DES_CBC, 1125 0, 0, swcr_newsession, swcr_freesession, swcr_process, NULL); 1126 #define REGISTER(alg) \ 1127 crypto_register(swcr_id, alg, 0, 0, NULL, NULL, NULL, NULL) 1128 1129 REGISTER(CRYPTO_3DES_CBC); 1130 REGISTER(CRYPTO_BLF_CBC); 1131 REGISTER(CRYPTO_CAST_CBC); 1132 REGISTER(CRYPTO_SKIPJACK_CBC); 1133 REGISTER(CRYPTO_NULL_CBC); 1134 REGISTER(CRYPTO_MD5_HMAC); 1135 REGISTER(CRYPTO_SHA1_HMAC); 1136 REGISTER(CRYPTO_SHA2_HMAC); 1137 REGISTER(CRYPTO_RIPEMD160_HMAC); 1138 REGISTER(CRYPTO_NULL_HMAC); 1139 REGISTER(CRYPTO_MD5_KPDK); 1140 REGISTER(CRYPTO_SHA1_KPDK); 1141 REGISTER(CRYPTO_MD5); 1142 REGISTER(CRYPTO_SHA1); 1143 REGISTER(CRYPTO_RIJNDAEL128_CBC); 1144 REGISTER(CRYPTO_DEFLATE_COMP); 1145 #undef REGISTER 1146 } 1147 1148 #ifdef __FreeBSD__ 1149 SYSINIT(cryptosoft_init, SI_SUB_PSEUDO, SI_ORDER_ANY, swcr_init, NULL) 1150 #endif 1151 1152 #ifdef __NetBSD__ 1153 /* 1154 * Pseudo-device init routine for software crypto. 1155 */ 1156 void swcryptoattach(int); 1157 1158 void 1159 swcryptoattach(int num) 1160 { 1161 1162 swcr_init(); 1163 } 1164 #endif /* __NetBSD__ */ 1165
Indexes created Wed Sep 24 05:09:52 GMT 2025