cryptosoft.c revision 1.18
1 /* $NetBSD: cryptosoft.c,v 1.18 2008/02/01 04:52:35 tls Exp $ */ 2 /* $FreeBSD: src/sys/opencrypto/cryptosoft.c,v 1.2.2.1 2002/11/21 23:34:23 sam Exp $ */ 3 /* $OpenBSD: cryptosoft.c,v 1.35 2002/04/26 08:43:50 deraadt Exp $ */ 4 5 /* 6 * The author of this code is Angelos D. Keromytis (angelos (at) cis.upenn.edu) 7 * 8 * This code was written by Angelos D. Keromytis in Athens, Greece, in 9 * February 2000. Network Security Technologies Inc. (NSTI) kindly 10 * supported the development of this code. 11 * 12 * Copyright (c) 2000, 2001 Angelos D. Keromytis 13 * 14 * Permission to use, copy, and modify this software with or without fee 15 * is hereby granted, provided that this entire notice is included in 16 * all source code copies of any software which is or includes a copy or 17 * modification of this software. 18 * 19 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 20 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 21 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 22 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 23 * PURPOSE. 24 */ 25 26 #include <sys/cdefs.h> 27 __KERNEL_RCSID(0, "$NetBSD: cryptosoft.c,v 1.18 2008/02/01 04:52:35 tls Exp $"); 28 29 #include <sys/param.h> 30 #include <sys/systm.h> 31 #include <sys/malloc.h> 32 #include <sys/mbuf.h> 33 #include <sys/sysctl.h> 34 #include <sys/errno.h> 35 36 #include <opencrypto/cryptodev.h> 37 #include <opencrypto/cryptosoft.h> 38 #include <opencrypto/xform.h> 39 40 #include <opencrypto/cryptosoft_xform.c> 41 42 union authctx { 43 MD5_CTX md5ctx; 44 SHA1_CTX sha1ctx; 45 RMD160_CTX rmd160ctx; 46 SHA256_CTX sha256ctx; 47 SHA384_CTX sha384ctx; 48 SHA512_CTX sha512ctx; 49 }; 50 51 struct swcr_data **swcr_sessions = NULL; 52 u_int32_t swcr_sesnum = 0; 53 int32_t swcr_id = -1; 54 55 #define COPYBACK(x, a, b, c, d) \ 56 (x) == CRYPTO_BUF_MBUF ? m_copyback((struct mbuf *)a,b,c,d) \ 57 : cuio_copyback((struct uio *)a,b,c,d) 58 #define COPYDATA(x, a, b, c, d) \ 59 (x) == CRYPTO_BUF_MBUF ? m_copydata((struct mbuf *)a,b,c,d) \ 60 : cuio_copydata((struct uio *)a,b,c,d) 61 62 static int swcr_encdec(struct cryptodesc *, struct swcr_data *, void *, int); 63 static int swcr_compdec(struct cryptodesc *, struct swcr_data *, void *, int); 64 static int swcr_process(void *, struct cryptop *, int); 65 static int swcr_newsession(void *, u_int32_t *, struct cryptoini *); 66 static int swcr_freesession(void *, u_int64_t); 67 68 /* 69 * Apply a symmetric encryption/decryption algorithm. 70 */ 71 static int 72 swcr_encdec(struct cryptodesc *crd, struct swcr_data *sw, void *bufv, 73 int outtype) 74 { 75 char *buf = bufv; 76 unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN], *idat; 77 unsigned char *ivp, piv[EALG_MAX_BLOCK_LEN]; 78 const struct swcr_enc_xform *exf; 79 int i, k, j, blks; 80 int count, ind; 81 82 exf = sw->sw_exf; 83 blks = exf->enc_xform->blocksize; 84 85 /* Check for non-padded data */ 86 if (crd->crd_len % blks) 87 return EINVAL; 88 89 /* Initialize the IV */ 90 if (crd->crd_flags & CRD_F_ENCRYPT) { 91 /* IV explicitly provided ? */ 92 if (crd->crd_flags & CRD_F_IV_EXPLICIT) 93 bcopy(crd->crd_iv, iv, blks); 94 else { 95 /* Get random IV */ 96 for (i = 0; 97 i + sizeof (u_int32_t) < EALG_MAX_BLOCK_LEN; 98 i += sizeof (u_int32_t)) { 99 u_int32_t temp = arc4random(); 100 101 bcopy(&temp, iv + i, sizeof(u_int32_t)); 102 } 103 /* 104 * What if the block size is not a multiple 105 * of sizeof (u_int32_t), which is the size of 106 * what arc4random() returns ? 107 */ 108 if (EALG_MAX_BLOCK_LEN % sizeof (u_int32_t) != 0) { 109 u_int32_t temp = arc4random(); 110 111 bcopy (&temp, iv + i, 112 EALG_MAX_BLOCK_LEN - i); 113 } 114 } 115 116 /* Do we need to write the IV */ 117 if (!(crd->crd_flags & CRD_F_IV_PRESENT)) { 118 COPYBACK(outtype, buf, crd->crd_inject, blks, iv); 119 } 120 121 } else { /* Decryption */ 122 /* IV explicitly provided ? */ 123 if (crd->crd_flags & CRD_F_IV_EXPLICIT) 124 bcopy(crd->crd_iv, iv, blks); 125 else { 126 /* Get IV off buf */ 127 COPYDATA(outtype, buf, crd->crd_inject, blks, iv); 128 } 129 } 130 131 ivp = iv; 132 133 if (outtype == CRYPTO_BUF_CONTIG) { 134 if (crd->crd_flags & CRD_F_ENCRYPT) { 135 for (i = crd->crd_skip; 136 i < crd->crd_skip + crd->crd_len; i += blks) { 137 /* XOR with the IV/previous block, as appropriate. */ 138 if (i == crd->crd_skip) 139 for (k = 0; k < blks; k++) 140 buf[i + k] ^= ivp[k]; 141 else 142 for (k = 0; k < blks; k++) 143 buf[i + k] ^= buf[i + k - blks]; 144 exf->encrypt(sw->sw_kschedule, buf + i); 145 } 146 } else { /* Decrypt */ 147 /* 148 * Start at the end, so we don't need to keep the encrypted 149 * block as the IV for the next block. 150 */ 151 for (i = crd->crd_skip + crd->crd_len - blks; 152 i >= crd->crd_skip; i -= blks) { 153 exf->decrypt(sw->sw_kschedule, buf + i); 154 155 /* XOR with the IV/previous block, as appropriate */ 156 if (i == crd->crd_skip) 157 for (k = 0; k < blks; k++) 158 buf[i + k] ^= ivp[k]; 159 else 160 for (k = 0; k < blks; k++) 161 buf[i + k] ^= buf[i + k - blks]; 162 } 163 } 164 165 return 0; 166 } else if (outtype == CRYPTO_BUF_MBUF) { 167 struct mbuf *m = (struct mbuf *) buf; 168 169 /* Find beginning of data */ 170 m = m_getptr(m, crd->crd_skip, &k); 171 if (m == NULL) 172 return EINVAL; 173 174 i = crd->crd_len; 175 176 while (i > 0) { 177 /* 178 * If there's insufficient data at the end of 179 * an mbuf, we have to do some copying. 180 */ 181 if (m->m_len < k + blks && m->m_len != k) { 182 m_copydata(m, k, blks, blk); 183 184 /* Actual encryption/decryption */ 185 if (crd->crd_flags & CRD_F_ENCRYPT) { 186 /* XOR with previous block */ 187 for (j = 0; j < blks; j++) 188 blk[j] ^= ivp[j]; 189 190 exf->encrypt(sw->sw_kschedule, blk); 191 192 /* 193 * Keep encrypted block for XOR'ing 194 * with next block 195 */ 196 bcopy(blk, iv, blks); 197 ivp = iv; 198 } else { /* decrypt */ 199 /* 200 * Keep encrypted block for XOR'ing 201 * with next block 202 */ 203 if (ivp == iv) 204 bcopy(blk, piv, blks); 205 else 206 bcopy(blk, iv, blks); 207 208 exf->decrypt(sw->sw_kschedule, blk); 209 210 /* XOR with previous block */ 211 for (j = 0; j < blks; j++) 212 blk[j] ^= ivp[j]; 213 214 if (ivp == iv) 215 bcopy(piv, iv, blks); 216 else 217 ivp = iv; 218 } 219 220 /* Copy back decrypted block */ 221 m_copyback(m, k, blks, blk); 222 223 /* Advance pointer */ 224 m = m_getptr(m, k + blks, &k); 225 if (m == NULL) 226 return EINVAL; 227 228 i -= blks; 229 230 /* Could be done... */ 231 if (i == 0) 232 break; 233 } 234 235 /* Skip possibly empty mbufs */ 236 if (k == m->m_len) { 237 for (m = m->m_next; m && m->m_len == 0; 238 m = m->m_next) 239 ; 240 k = 0; 241 } 242 243 /* Sanity check */ 244 if (m == NULL) 245 return EINVAL; 246 247 /* 248 * Warning: idat may point to garbage here, but 249 * we only use it in the while() loop, only if 250 * there are indeed enough data. 251 */ 252 idat = mtod(m, unsigned char *) + k; 253 254 while (m->m_len >= k + blks && i > 0) { 255 if (crd->crd_flags & CRD_F_ENCRYPT) { 256 /* XOR with previous block/IV */ 257 for (j = 0; j < blks; j++) 258 idat[j] ^= ivp[j]; 259 260 exf->encrypt(sw->sw_kschedule, idat); 261 ivp = idat; 262 } else { /* decrypt */ 263 /* 264 * Keep encrypted block to be used 265 * in next block's processing. 266 */ 267 if (ivp == iv) 268 bcopy(idat, piv, blks); 269 else 270 bcopy(idat, iv, blks); 271 272 exf->decrypt(sw->sw_kschedule, idat); 273 274 /* XOR with previous block/IV */ 275 for (j = 0; j < blks; j++) 276 idat[j] ^= ivp[j]; 277 278 if (ivp == iv) 279 bcopy(piv, iv, blks); 280 else 281 ivp = iv; 282 } 283 284 idat += blks; 285 k += blks; 286 i -= blks; 287 } 288 } 289 290 return 0; /* Done with mbuf encryption/decryption */ 291 } else if (outtype == CRYPTO_BUF_IOV) { 292 struct uio *uio = (struct uio *) buf; 293 294 /* Find beginning of data */ 295 count = crd->crd_skip; 296 ind = cuio_getptr(uio, count, &k); 297 if (ind == -1) 298 return EINVAL; 299 300 i = crd->crd_len; 301 302 while (i > 0) { 303 /* 304 * If there's insufficient data at the end, 305 * we have to do some copying. 306 */ 307 if (uio->uio_iov[ind].iov_len < k + blks && 308 uio->uio_iov[ind].iov_len != k) { 309 cuio_copydata(uio, k, blks, blk); 310 311 /* Actual encryption/decryption */ 312 if (crd->crd_flags & CRD_F_ENCRYPT) { 313 /* XOR with previous block */ 314 for (j = 0; j < blks; j++) 315 blk[j] ^= ivp[j]; 316 317 exf->encrypt(sw->sw_kschedule, blk); 318 319 /* 320 * Keep encrypted block for XOR'ing 321 * with next block 322 */ 323 bcopy(blk, iv, blks); 324 ivp = iv; 325 } else { /* decrypt */ 326 /* 327 * Keep encrypted block for XOR'ing 328 * with next block 329 */ 330 if (ivp == iv) 331 bcopy(blk, piv, blks); 332 else 333 bcopy(blk, iv, blks); 334 335 exf->decrypt(sw->sw_kschedule, blk); 336 337 /* XOR with previous block */ 338 for (j = 0; j < blks; j++) 339 blk[j] ^= ivp[j]; 340 341 if (ivp == iv) 342 bcopy(piv, iv, blks); 343 else 344 ivp = iv; 345 } 346 347 /* Copy back decrypted block */ 348 cuio_copyback(uio, k, blks, blk); 349 350 count += blks; 351 352 /* Advance pointer */ 353 ind = cuio_getptr(uio, count, &k); 354 if (ind == -1) 355 return (EINVAL); 356 357 i -= blks; 358 359 /* Could be done... */ 360 if (i == 0) 361 break; 362 } 363 364 /* 365 * Warning: idat may point to garbage here, but 366 * we only use it in the while() loop, only if 367 * there are indeed enough data. 368 */ 369 idat = ((char *)uio->uio_iov[ind].iov_base) + k; 370 371 while (uio->uio_iov[ind].iov_len >= k + blks && 372 i > 0) { 373 if (crd->crd_flags & CRD_F_ENCRYPT) { 374 /* XOR with previous block/IV */ 375 for (j = 0; j < blks; j++) 376 idat[j] ^= ivp[j]; 377 378 exf->encrypt(sw->sw_kschedule, idat); 379 ivp = idat; 380 } else { /* decrypt */ 381 /* 382 * Keep encrypted block to be used 383 * in next block's processing. 384 */ 385 if (ivp == iv) 386 bcopy(idat, piv, blks); 387 else 388 bcopy(idat, iv, blks); 389 390 exf->decrypt(sw->sw_kschedule, idat); 391 392 /* XOR with previous block/IV */ 393 for (j = 0; j < blks; j++) 394 idat[j] ^= ivp[j]; 395 396 if (ivp == iv) 397 bcopy(piv, iv, blks); 398 else 399 ivp = iv; 400 } 401 402 idat += blks; 403 count += blks; 404 k += blks; 405 i -= blks; 406 } 407 } 408 return 0; /* Done with mbuf encryption/decryption */ 409 } 410 411 /* Unreachable */ 412 return EINVAL; 413 } 414 415 /* 416 * Compute keyed-hash authenticator. 417 */ 418 int 419 swcr_authcompute(struct cryptop *crp, struct cryptodesc *crd, 420 struct swcr_data *sw, void *buf, int outtype) 421 { 422 unsigned char aalg[AALG_MAX_RESULT_LEN]; 423 const struct swcr_auth_hash *axf; 424 union authctx ctx; 425 int err; 426 427 if (sw->sw_ictx == 0) 428 return EINVAL; 429 430 axf = sw->sw_axf; 431 432 bcopy(sw->sw_ictx, &ctx, axf->auth_hash->ctxsize); 433 434 switch (outtype) { 435 case CRYPTO_BUF_CONTIG: 436 axf->Update(&ctx, (char *)buf + crd->crd_skip, crd->crd_len); 437 break; 438 case CRYPTO_BUF_MBUF: 439 err = m_apply((struct mbuf *) buf, crd->crd_skip, crd->crd_len, 440 (int (*)(void*, void *, unsigned int)) axf->Update, 441 (void *) &ctx); 442 if (err) 443 return err; 444 break; 445 case CRYPTO_BUF_IOV: 446 err = cuio_apply((struct uio *) buf, crd->crd_skip, 447 crd->crd_len, 448 (int (*)(void *, void *, unsigned int)) axf->Update, 449 (void *) &ctx); 450 if (err) { 451 return err; 452 } 453 break; 454 default: 455 return EINVAL; 456 } 457 458 switch (sw->sw_alg) { 459 case CRYPTO_MD5_HMAC: 460 case CRYPTO_SHA1_HMAC: 461 case CRYPTO_SHA2_HMAC: 462 case CRYPTO_RIPEMD160_HMAC: 463 if (sw->sw_octx == NULL) 464 return EINVAL; 465 466 axf->Final(aalg, &ctx); 467 bcopy(sw->sw_octx, &ctx, axf->auth_hash->ctxsize); 468 axf->Update(&ctx, aalg, axf->auth_hash->hashsize); 469 axf->Final(aalg, &ctx); 470 break; 471 472 case CRYPTO_MD5_KPDK: 473 case CRYPTO_SHA1_KPDK: 474 if (sw->sw_octx == NULL) 475 return EINVAL; 476 477 axf->Update(&ctx, sw->sw_octx, sw->sw_klen); 478 axf->Final(aalg, &ctx); 479 break; 480 481 case CRYPTO_NULL_HMAC: 482 case CRYPTO_MD5: 483 case CRYPTO_SHA1: 484 axf->Final(aalg, &ctx); 485 break; 486 } 487 488 /* Inject the authentication data */ 489 switch (outtype) { 490 case CRYPTO_BUF_CONTIG: 491 (void)memcpy((char *)buf + crd->crd_inject, aalg, 492 axf->auth_hash->authsize); 493 break; 494 case CRYPTO_BUF_MBUF: 495 m_copyback((struct mbuf *) buf, crd->crd_inject, 496 axf->auth_hash->authsize, aalg); 497 break; 498 case CRYPTO_BUF_IOV: 499 bcopy(aalg, crp->crp_mac, axf->auth_hash->authsize); 500 break; 501 default: 502 return EINVAL; 503 } 504 return 0; 505 } 506 507 /* 508 * Apply a compression/decompression algorithm 509 */ 510 static int 511 swcr_compdec(struct cryptodesc *crd, struct swcr_data *sw, 512 void *buf, int outtype) 513 { 514 u_int8_t *data, *out; 515 const struct swcr_comp_algo *cxf; 516 int adj; 517 u_int32_t result; 518 519 cxf = sw->sw_cxf; 520 521 /* We must handle the whole buffer of data in one time 522 * then if there is not all the data in the mbuf, we must 523 * copy in a buffer. 524 */ 525 526 data = malloc(crd->crd_len, M_CRYPTO_DATA, M_NOWAIT); 527 if (data == NULL) 528 return (EINVAL); 529 COPYDATA(outtype, buf, crd->crd_skip, crd->crd_len, data); 530 531 if (crd->crd_flags & CRD_F_COMP) 532 result = cxf->compress(data, crd->crd_len, &out); 533 else 534 result = cxf->decompress(data, crd->crd_len, &out); 535 536 FREE(data, M_CRYPTO_DATA); 537 if (result == 0) 538 return EINVAL; 539 540 /* Copy back the (de)compressed data. m_copyback is 541 * extending the mbuf as necessary. 542 */ 543 sw->sw_size = result; 544 /* Check the compressed size when doing compression */ 545 if (crd->crd_flags & CRD_F_COMP) { 546 if (result > crd->crd_len) { 547 /* Compression was useless, we lost time */ 548 FREE(out, M_CRYPTO_DATA); 549 return 0; 550 } 551 } 552 553 COPYBACK(outtype, buf, crd->crd_skip, result, out); 554 if (result < crd->crd_len) { 555 adj = result - crd->crd_len; 556 if (outtype == CRYPTO_BUF_MBUF) { 557 adj = result - crd->crd_len; 558 m_adj((struct mbuf *)buf, adj); 559 } else { 560 struct uio *uio = (struct uio *)buf; 561 int ind; 562 563 adj = crd->crd_len - result; 564 ind = uio->uio_iovcnt - 1; 565 566 while (adj > 0 && ind >= 0) { 567 if (adj < uio->uio_iov[ind].iov_len) { 568 uio->uio_iov[ind].iov_len -= adj; 569 break; 570 } 571 572 adj -= uio->uio_iov[ind].iov_len; 573 uio->uio_iov[ind].iov_len = 0; 574 ind--; 575 uio->uio_iovcnt--; 576 } 577 } 578 } 579 FREE(out, M_CRYPTO_DATA); 580 return 0; 581 } 582 583 /* 584 * Generate a new software session. 585 */ 586 static int 587 swcr_newsession(void *arg, u_int32_t *sid, struct cryptoini *cri) 588 { 589 struct swcr_data **swd; 590 const struct swcr_auth_hash *axf; 591 const struct swcr_enc_xform *txf; 592 const struct swcr_comp_algo *cxf; 593 u_int32_t i; 594 int k, error; 595 596 if (sid == NULL || cri == NULL) 597 return EINVAL; 598 599 if (swcr_sessions) { 600 for (i = 1; i < swcr_sesnum; i++) 601 if (swcr_sessions[i] == NULL) 602 break; 603 } else 604 i = 1; /* NB: to silence compiler warning */ 605 606 if (swcr_sessions == NULL || i == swcr_sesnum) { 607 if (swcr_sessions == NULL) { 608 i = 1; /* We leave swcr_sessions[0] empty */ 609 swcr_sesnum = CRYPTO_SW_SESSIONS; 610 } else 611 swcr_sesnum *= 2; 612 613 swd = malloc(swcr_sesnum * sizeof(struct swcr_data *), 614 M_CRYPTO_DATA, M_NOWAIT); 615 if (swd == NULL) { 616 /* Reset session number */ 617 if (swcr_sesnum == CRYPTO_SW_SESSIONS) 618 swcr_sesnum = 0; 619 else 620 swcr_sesnum /= 2; 621 return ENOBUFS; 622 } 623 624 bzero(swd, swcr_sesnum * sizeof(struct swcr_data *)); 625 626 /* Copy existing sessions */ 627 if (swcr_sessions) { 628 bcopy(swcr_sessions, swd, 629 (swcr_sesnum / 2) * sizeof(struct swcr_data *)); 630 free(swcr_sessions, M_CRYPTO_DATA); 631 } 632 633 swcr_sessions = swd; 634 } 635 636 swd = &swcr_sessions[i]; 637 *sid = i; 638 639 while (cri) { 640 *swd = malloc(sizeof **swd, M_CRYPTO_DATA, M_NOWAIT); 641 if (*swd == NULL) { 642 swcr_freesession(NULL, i); 643 return ENOBUFS; 644 } 645 bzero(*swd, sizeof(struct swcr_data)); 646 647 switch (cri->cri_alg) { 648 case CRYPTO_DES_CBC: 649 txf = &swcr_enc_xform_des; 650 goto enccommon; 651 case CRYPTO_3DES_CBC: 652 txf = &swcr_enc_xform_3des; 653 goto enccommon; 654 case CRYPTO_BLF_CBC: 655 txf = &swcr_enc_xform_blf; 656 goto enccommon; 657 case CRYPTO_CAST_CBC: 658 txf = &swcr_enc_xform_cast5; 659 goto enccommon; 660 case CRYPTO_SKIPJACK_CBC: 661 txf = &swcr_enc_xform_skipjack; 662 goto enccommon; 663 case CRYPTO_RIJNDAEL128_CBC: 664 txf = &swcr_enc_xform_rijndael128; 665 goto enccommon; 666 case CRYPTO_NULL_CBC: 667 txf = &swcr_enc_xform_null; 668 goto enccommon; 669 enccommon: 670 error = txf->setkey(&((*swd)->sw_kschedule), 671 cri->cri_key, cri->cri_klen / 8); 672 if (error) { 673 swcr_freesession(NULL, i); 674 return error; 675 } 676 (*swd)->sw_exf = txf; 677 break; 678 679 case CRYPTO_MD5_HMAC: 680 axf = &swcr_auth_hash_hmac_md5_96; 681 goto authcommon; 682 case CRYPTO_SHA1_HMAC: 683 axf = &swcr_auth_hash_hmac_sha1_96; 684 goto authcommon; 685 case CRYPTO_SHA2_HMAC: 686 if (cri->cri_klen == 256) 687 axf = &swcr_auth_hash_hmac_sha2_256; 688 else if (cri->cri_klen == 384) 689 axf = &swcr_auth_hash_hmac_sha2_384; 690 else if (cri->cri_klen == 512) 691 axf = &swcr_auth_hash_hmac_sha2_512; 692 else { 693 swcr_freesession(NULL, i); 694 return EINVAL; 695 } 696 goto authcommon; 697 case CRYPTO_NULL_HMAC: 698 axf = &swcr_auth_hash_null; 699 goto authcommon; 700 case CRYPTO_RIPEMD160_HMAC: 701 axf = &swcr_auth_hash_hmac_ripemd_160_96; 702 authcommon: 703 (*swd)->sw_ictx = malloc(axf->auth_hash->ctxsize, 704 M_CRYPTO_DATA, M_NOWAIT); 705 if ((*swd)->sw_ictx == NULL) { 706 swcr_freesession(NULL, i); 707 return ENOBUFS; 708 } 709 710 (*swd)->sw_octx = malloc(axf->auth_hash->ctxsize, 711 M_CRYPTO_DATA, M_NOWAIT); 712 if ((*swd)->sw_octx == NULL) { 713 swcr_freesession(NULL, i); 714 return ENOBUFS; 715 } 716 717 for (k = 0; k < cri->cri_klen / 8; k++) 718 cri->cri_key[k] ^= HMAC_IPAD_VAL; 719 720 axf->Init((*swd)->sw_ictx); 721 axf->Update((*swd)->sw_ictx, cri->cri_key, 722 cri->cri_klen / 8); 723 axf->Update((*swd)->sw_ictx, hmac_ipad_buffer, 724 HMAC_BLOCK_LEN - (cri->cri_klen / 8)); 725 726 for (k = 0; k < cri->cri_klen / 8; k++) 727 cri->cri_key[k] ^= (HMAC_IPAD_VAL ^ HMAC_OPAD_VAL); 728 729 axf->Init((*swd)->sw_octx); 730 axf->Update((*swd)->sw_octx, cri->cri_key, 731 cri->cri_klen / 8); 732 axf->Update((*swd)->sw_octx, hmac_opad_buffer, 733 HMAC_BLOCK_LEN - (cri->cri_klen / 8)); 734 735 for (k = 0; k < cri->cri_klen / 8; k++) 736 cri->cri_key[k] ^= HMAC_OPAD_VAL; 737 (*swd)->sw_axf = axf; 738 break; 739 740 case CRYPTO_MD5_KPDK: 741 axf = &swcr_auth_hash_key_md5; 742 goto auth2common; 743 744 case CRYPTO_SHA1_KPDK: 745 axf = &swcr_auth_hash_key_sha1; 746 auth2common: 747 (*swd)->sw_ictx = malloc(axf->auth_hash->ctxsize, 748 M_CRYPTO_DATA, M_NOWAIT); 749 if ((*swd)->sw_ictx == NULL) { 750 swcr_freesession(NULL, i); 751 return ENOBUFS; 752 } 753 754 /* Store the key so we can "append" it to the payload */ 755 (*swd)->sw_octx = malloc(cri->cri_klen / 8, M_CRYPTO_DATA, 756 M_NOWAIT); 757 if ((*swd)->sw_octx == NULL) { 758 swcr_freesession(NULL, i); 759 return ENOBUFS; 760 } 761 762 (*swd)->sw_klen = cri->cri_klen / 8; 763 bcopy(cri->cri_key, (*swd)->sw_octx, cri->cri_klen / 8); 764 axf->Init((*swd)->sw_ictx); 765 axf->Update((*swd)->sw_ictx, cri->cri_key, 766 cri->cri_klen / 8); 767 axf->Final(NULL, (*swd)->sw_ictx); 768 (*swd)->sw_axf = axf; 769 break; 770 771 case CRYPTO_MD5: 772 axf = &swcr_auth_hash_md5; 773 goto auth3common; 774 775 case CRYPTO_SHA1: 776 axf = &swcr_auth_hash_sha1; 777 auth3common: 778 (*swd)->sw_ictx = malloc(axf->auth_hash->ctxsize, 779 M_CRYPTO_DATA, M_NOWAIT); 780 if ((*swd)->sw_ictx == NULL) { 781 swcr_freesession(NULL, i); 782 return ENOBUFS; 783 } 784 785 axf->Init((*swd)->sw_ictx); 786 (*swd)->sw_axf = axf; 787 break; 788 789 case CRYPTO_DEFLATE_COMP: 790 cxf = &swcr_comp_algo_deflate; 791 (*swd)->sw_cxf = cxf; 792 break; 793 default: 794 swcr_freesession(NULL, i); 795 return EINVAL; 796 } 797 798 (*swd)->sw_alg = cri->cri_alg; 799 cri = cri->cri_next; 800 swd = &((*swd)->sw_next); 801 } 802 return 0; 803 } 804 805 /* 806 * Free a session. 807 */ 808 static int 809 swcr_freesession(void *arg, u_int64_t tid) 810 { 811 struct swcr_data *swd; 812 const struct swcr_enc_xform *txf; 813 const struct swcr_auth_hash *axf; 814 const struct swcr_comp_algo *cxf; 815 u_int32_t sid = ((u_int32_t) tid) & 0xffffffff; 816 817 if (sid > swcr_sesnum || swcr_sessions == NULL || 818 swcr_sessions[sid] == NULL) 819 return EINVAL; 820 821 /* Silently accept and return */ 822 if (sid == 0) 823 return 0; 824 825 while ((swd = swcr_sessions[sid]) != NULL) { 826 swcr_sessions[sid] = swd->sw_next; 827 828 switch (swd->sw_alg) { 829 case CRYPTO_DES_CBC: 830 case CRYPTO_3DES_CBC: 831 case CRYPTO_BLF_CBC: 832 case CRYPTO_CAST_CBC: 833 case CRYPTO_SKIPJACK_CBC: 834 case CRYPTO_RIJNDAEL128_CBC: 835 case CRYPTO_NULL_CBC: 836 txf = swd->sw_exf; 837 838 if (swd->sw_kschedule) 839 txf->zerokey(&(swd->sw_kschedule)); 840 break; 841 842 case CRYPTO_MD5_HMAC: 843 case CRYPTO_SHA1_HMAC: 844 case CRYPTO_SHA2_HMAC: 845 case CRYPTO_RIPEMD160_HMAC: 846 case CRYPTO_NULL_HMAC: 847 axf = swd->sw_axf; 848 849 if (swd->sw_ictx) { 850 bzero(swd->sw_ictx, axf->auth_hash->ctxsize); 851 free(swd->sw_ictx, M_CRYPTO_DATA); 852 } 853 if (swd->sw_octx) { 854 bzero(swd->sw_octx, axf->auth_hash->ctxsize); 855 free(swd->sw_octx, M_CRYPTO_DATA); 856 } 857 break; 858 859 case CRYPTO_MD5_KPDK: 860 case CRYPTO_SHA1_KPDK: 861 axf = swd->sw_axf; 862 863 if (swd->sw_ictx) { 864 bzero(swd->sw_ictx, axf->auth_hash->ctxsize); 865 free(swd->sw_ictx, M_CRYPTO_DATA); 866 } 867 if (swd->sw_octx) { 868 bzero(swd->sw_octx, swd->sw_klen); 869 free(swd->sw_octx, M_CRYPTO_DATA); 870 } 871 break; 872 873 case CRYPTO_MD5: 874 case CRYPTO_SHA1: 875 axf = swd->sw_axf; 876 877 if (swd->sw_ictx) 878 free(swd->sw_ictx, M_CRYPTO_DATA); 879 break; 880 881 case CRYPTO_DEFLATE_COMP: 882 cxf = swd->sw_cxf; 883 break; 884 } 885 886 FREE(swd, M_CRYPTO_DATA); 887 } 888 return 0; 889 } 890 891 /* 892 * Process a software request. 893 */ 894 static int 895 swcr_process(void *arg, struct cryptop *crp, int hint) 896 { 897 struct cryptodesc *crd; 898 struct swcr_data *sw; 899 u_int32_t lid; 900 int type; 901 902 /* Sanity check */ 903 if (crp == NULL) 904 return EINVAL; 905 906 if (crp->crp_desc == NULL || crp->crp_buf == NULL) { 907 crp->crp_etype = EINVAL; 908 goto done; 909 } 910 911 lid = crp->crp_sid & 0xffffffff; 912 if (lid >= swcr_sesnum || lid == 0 || swcr_sessions[lid] == NULL) { 913 crp->crp_etype = ENOENT; 914 goto done; 915 } 916 917 if (crp->crp_flags & CRYPTO_F_IMBUF) { 918 type = CRYPTO_BUF_MBUF; 919 } else if (crp->crp_flags & CRYPTO_F_IOV) { 920 type = CRYPTO_BUF_IOV; 921 } else { 922 type = CRYPTO_BUF_CONTIG; 923 } 924 925 /* Go through crypto descriptors, processing as we go */ 926 for (crd = crp->crp_desc; crd; crd = crd->crd_next) { 927 /* 928 * Find the crypto context. 929 * 930 * XXX Note that the logic here prevents us from having 931 * XXX the same algorithm multiple times in a session 932 * XXX (or rather, we can but it won't give us the right 933 * XXX results). To do that, we'd need some way of differentiating 934 * XXX between the various instances of an algorithm (so we can 935 * XXX locate the correct crypto context). 936 */ 937 for (sw = swcr_sessions[lid]; 938 sw && sw->sw_alg != crd->crd_alg; 939 sw = sw->sw_next) 940 ; 941 942 /* No such context ? */ 943 if (sw == NULL) { 944 crp->crp_etype = EINVAL; 945 goto done; 946 } 947 948 switch (sw->sw_alg) { 949 case CRYPTO_DES_CBC: 950 case CRYPTO_3DES_CBC: 951 case CRYPTO_BLF_CBC: 952 case CRYPTO_CAST_CBC: 953 case CRYPTO_SKIPJACK_CBC: 954 case CRYPTO_RIJNDAEL128_CBC: 955 if ((crp->crp_etype = swcr_encdec(crd, sw, 956 crp->crp_buf, type)) != 0) 957 goto done; 958 break; 959 case CRYPTO_NULL_CBC: 960 crp->crp_etype = 0; 961 break; 962 case CRYPTO_MD5_HMAC: 963 case CRYPTO_SHA1_HMAC: 964 case CRYPTO_SHA2_HMAC: 965 case CRYPTO_RIPEMD160_HMAC: 966 case CRYPTO_NULL_HMAC: 967 case CRYPTO_MD5_KPDK: 968 case CRYPTO_SHA1_KPDK: 969 case CRYPTO_MD5: 970 case CRYPTO_SHA1: 971 if ((crp->crp_etype = swcr_authcompute(crp, crd, sw, 972 crp->crp_buf, type)) != 0) 973 goto done; 974 break; 975 976 case CRYPTO_DEFLATE_COMP: 977 if ((crp->crp_etype = swcr_compdec(crd, sw, 978 crp->crp_buf, type)) != 0) 979 goto done; 980 else 981 crp->crp_olen = (int)sw->sw_size; 982 break; 983 984 default: 985 /* Unknown/unsupported algorithm */ 986 crp->crp_etype = EINVAL; 987 goto done; 988 } 989 } 990 991 done: 992 crypto_done(crp); 993 return 0; 994 } 995 996 static void 997 swcr_init(void) 998 { 999 swcr_id = crypto_get_driverid(CRYPTOCAP_F_SOFTWARE); 1000 if (swcr_id < 0) { 1001 /* This should never happen */ 1002 panic("Software crypto device cannot initialize!"); 1003 } 1004 1005 crypto_register(swcr_id, CRYPTO_DES_CBC, 1006 0, 0, swcr_newsession, swcr_freesession, swcr_process, NULL); 1007 #define REGISTER(alg) \ 1008 crypto_register(swcr_id, alg, 0, 0, NULL, NULL, NULL, NULL) 1009 1010 REGISTER(CRYPTO_3DES_CBC); 1011 REGISTER(CRYPTO_BLF_CBC); 1012 REGISTER(CRYPTO_CAST_CBC); 1013 REGISTER(CRYPTO_SKIPJACK_CBC); 1014 REGISTER(CRYPTO_NULL_CBC); 1015 REGISTER(CRYPTO_MD5_HMAC); 1016 REGISTER(CRYPTO_SHA1_HMAC); 1017 REGISTER(CRYPTO_SHA2_HMAC); 1018 REGISTER(CRYPTO_RIPEMD160_HMAC); 1019 REGISTER(CRYPTO_NULL_HMAC); 1020 REGISTER(CRYPTO_MD5_KPDK); 1021 REGISTER(CRYPTO_SHA1_KPDK); 1022 REGISTER(CRYPTO_MD5); 1023 REGISTER(CRYPTO_SHA1); 1024 REGISTER(CRYPTO_RIJNDAEL128_CBC); 1025 REGISTER(CRYPTO_DEFLATE_COMP); 1026 #undef REGISTER 1027 } 1028 1029 1030 /* 1031 * Pseudo-device init routine for software crypto. 1032 */ 1033 void swcryptoattach(int); 1034 1035 void 1036 swcryptoattach(int num) 1037 { 1038 1039 swcr_init(); 1040 } 1041
Indexes created Tue Sep 30 07:10:03 GMT 2025