Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/opencrypto/cryptosoft.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* $OpenBSD: cryptosoft.c,v 1.35 2002/04/26 08:43:50 deraadt Exp $ */ 2 3 /*- 4 * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu) 5 * Copyright (c) 2002-2006 Sam Leffler, Errno Consulting 6 * 7 * This code was written by Angelos D. Keromytis in Athens, Greece, in 8 * February 2000. Network Security Technologies Inc. (NSTI) kindly 9 * supported the development of this code. 10 * 11 * Copyright (c) 2000, 2001 Angelos D. Keromytis 12 * 13 * Permission to use, copy, and modify this software with or without fee 14 * is hereby granted, provided that this entire notice is included in 15 * all source code copies of any software which is or includes a copy or 16 * modification of this software. 17 * 18 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 19 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 20 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 21 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 22 * PURPOSE. 23 */ 24 25 #include <sys/cdefs.h> 26 __FBSDID("$FreeBSD$"); 27 28 #include <sys/param.h> 29 #include <sys/systm.h> 30 #include <sys/malloc.h> 31 #include <sys/mbuf.h> 32 #include <sys/module.h> 33 #include <sys/sysctl.h> 34 #include <sys/errno.h> 35 #include <sys/random.h> 36 #include <sys/kernel.h> 37 #include <sys/uio.h> 38 39 #include <crypto/blowfish/blowfish.h> 40 #include <crypto/sha1.h> 41 #include <opencrypto/rmd160.h> 42 #include <opencrypto/cast.h> 43 #include <opencrypto/skipjack.h> 44 #include <sys/md5.h> 45 46 #include <opencrypto/cryptodev.h> 47 #include <opencrypto/cryptosoft.h> 48 #include <opencrypto/xform.h> 49 50 #include <sys/kobj.h> 51 #include <sys/bus.h> 52 #include "cryptodev_if.h" 53 54 static int32_t swcr_id; 55 static struct swcr_data **swcr_sessions = NULL; 56 static u_int32_t swcr_sesnum; 57 58 u_int8_t hmac_ipad_buffer[HMAC_MAX_BLOCK_LEN]; 59 u_int8_t hmac_opad_buffer[HMAC_MAX_BLOCK_LEN]; 60 61 static int swcr_encdec(struct cryptodesc *, struct swcr_data *, caddr_t, int); 62 static int swcr_authcompute(struct cryptodesc *, struct swcr_data *, caddr_t, int); 63 static int swcr_compdec(struct cryptodesc *, struct swcr_data *, caddr_t, int); 64 static int swcr_freesession(device_t dev, u_int64_t tid); 65 66 /* 67 * Apply a symmetric encryption/decryption algorithm. 68 */ 69 static int 70 swcr_encdec(struct cryptodesc *crd, struct swcr_data *sw, caddr_t buf, 71 int flags) 72 { 73 unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN], *idat; 74 unsigned char *ivp, piv[EALG_MAX_BLOCK_LEN]; 75 struct enc_xform *exf; 76 int i, k, j, blks; 77 78 exf = sw->sw_exf; 79 blks = exf->blocksize; 80 81 /* Check for non-padded data */ 82 if (crd->crd_len % blks) 83 return EINVAL; 84 85 /* Initialize the IV */ 86 if (crd->crd_flags & CRD_F_ENCRYPT) { 87 /* IV explicitly provided ? */ 88 if (crd->crd_flags & CRD_F_IV_EXPLICIT) 89 bcopy(crd->crd_iv, iv, blks); 90 else 91 arc4rand(iv, blks, 0); 92 93 /* Do we need to write the IV */ 94 if (!(crd->crd_flags & CRD_F_IV_PRESENT)) 95 crypto_copyback(flags, buf, crd->crd_inject, blks, iv); 96 97 } else { /* Decryption */ 98 /* IV explicitly provided ? */ 99 if (crd->crd_flags & CRD_F_IV_EXPLICIT) 100 bcopy(crd->crd_iv, iv, blks); 101 else { 102 /* Get IV off buf */ 103 crypto_copydata(flags, buf, crd->crd_inject, blks, iv); 104 } 105 } 106 107 if (crd->crd_flags & CRD_F_KEY_EXPLICIT) { 108 int error; 109 110 if (sw->sw_kschedule) 111 exf->zerokey(&(sw->sw_kschedule)); 112 error = exf->setkey(&sw->sw_kschedule, 113 crd->crd_key, crd->crd_klen / 8); 114 if (error) 115 return (error); 116 } 117 ivp = iv; 118 119 if (flags & CRYPTO_F_IMBUF) { 120 struct mbuf *m = (struct mbuf *) buf; 121 122 /* Find beginning of data */ 123 m = m_getptr(m, crd->crd_skip, &k); 124 if (m == NULL) 125 return EINVAL; 126 127 i = crd->crd_len; 128 129 while (i > 0) { 130 /* 131 * If there's insufficient data at the end of 132 * an mbuf, we have to do some copying. 133 */ 134 if (m->m_len < k + blks && m->m_len != k) { 135 m_copydata(m, k, blks, blk); 136 137 /* Actual encryption/decryption */ 138 if (crd->crd_flags & CRD_F_ENCRYPT) { 139 /* XOR with previous block */ 140 for (j = 0; j < blks; j++) 141 blk[j] ^= ivp[j]; 142 143 exf->encrypt(sw->sw_kschedule, blk); 144 145 /* 146 * Keep encrypted block for XOR'ing 147 * with next block 148 */ 149 bcopy(blk, iv, blks); 150 ivp = iv; 151 } else { /* decrypt */ 152 /* 153 * Keep encrypted block for XOR'ing 154 * with next block 155 */ 156 if (ivp == iv) 157 bcopy(blk, piv, blks); 158 else 159 bcopy(blk, iv, blks); 160 161 exf->decrypt(sw->sw_kschedule, blk); 162 163 /* XOR with previous block */ 164 for (j = 0; j < blks; j++) 165 blk[j] ^= ivp[j]; 166 167 if (ivp == iv) 168 bcopy(piv, iv, blks); 169 else 170 ivp = iv; 171 } 172 173 /* Copy back decrypted block */ 174 m_copyback(m, k, blks, blk); 175 176 /* Advance pointer */ 177 m = m_getptr(m, k + blks, &k); 178 if (m == NULL) 179 return EINVAL; 180 181 i -= blks; 182 183 /* Could be done... */ 184 if (i == 0) 185 break; 186 } 187 188 /* Skip possibly empty mbufs */ 189 if (k == m->m_len) { 190 for (m = m->m_next; m && m->m_len == 0; 191 m = m->m_next) 192 ; 193 k = 0; 194 } 195 196 /* Sanity check */ 197 if (m == NULL) 198 return EINVAL; 199 200 /* 201 * Warning: idat may point to garbage here, but 202 * we only use it in the while() loop, only if 203 * there are indeed enough data. 204 */ 205 idat = mtod(m, unsigned char *) + k; 206 207 while (m->m_len >= k + blks && i > 0) { 208 if (crd->crd_flags & CRD_F_ENCRYPT) { 209 /* XOR with previous block/IV */ 210 for (j = 0; j < blks; j++) 211 idat[j] ^= ivp[j]; 212 213 exf->encrypt(sw->sw_kschedule, idat); 214 ivp = idat; 215 } else { /* decrypt */ 216 /* 217 * Keep encrypted block to be used 218 * in next block's processing. 219 */ 220 if (ivp == iv) 221 bcopy(idat, piv, blks); 222 else 223 bcopy(idat, iv, blks); 224 225 exf->decrypt(sw->sw_kschedule, idat); 226 227 /* XOR with previous block/IV */ 228 for (j = 0; j < blks; j++) 229 idat[j] ^= ivp[j]; 230 231 if (ivp == iv) 232 bcopy(piv, iv, blks); 233 else 234 ivp = iv; 235 } 236 237 idat += blks; 238 k += blks; 239 i -= blks; 240 } 241 } 242 243 return 0; /* Done with mbuf encryption/decryption */ 244 } else if (flags & CRYPTO_F_IOV) { 245 struct uio *uio = (struct uio *) buf; 246 struct iovec *iov; 247 248 /* Find beginning of data */ 249 iov = cuio_getptr(uio, crd->crd_skip, &k); 250 if (iov == NULL) 251 return EINVAL; 252 253 i = crd->crd_len; 254 255 while (i > 0) { 256 /* 257 * If there's insufficient data at the end of 258 * an iovec, we have to do some copying. 259 */ 260 if (iov->iov_len < k + blks && iov->iov_len != k) { 261 cuio_copydata(uio, k, blks, blk); 262 263 /* Actual encryption/decryption */ 264 if (crd->crd_flags & CRD_F_ENCRYPT) { 265 /* XOR with previous block */ 266 for (j = 0; j < blks; j++) 267 blk[j] ^= ivp[j]; 268 269 exf->encrypt(sw->sw_kschedule, blk); 270 271 /* 272 * Keep encrypted block for XOR'ing 273 * with next block 274 */ 275 bcopy(blk, iv, blks); 276 ivp = iv; 277 } else { /* decrypt */ 278 /* 279 * Keep encrypted block for XOR'ing 280 * with next block 281 */ 282 if (ivp == iv) 283 bcopy(blk, piv, blks); 284 else 285 bcopy(blk, iv, blks); 286 287 exf->decrypt(sw->sw_kschedule, blk); 288 289 /* XOR with previous block */ 290 for (j = 0; j < blks; j++) 291 blk[j] ^= ivp[j]; 292 293 if (ivp == iv) 294 bcopy(piv, iv, blks); 295 else 296 ivp = iv; 297 } 298 299 /* Copy back decrypted block */ 300 cuio_copyback(uio, k, blks, blk); 301 302 /* Advance pointer */ 303 iov = cuio_getptr(uio, k + blks, &k); 304 if (iov == NULL) 305 return EINVAL; 306 307 i -= blks; 308 309 /* Could be done... */ 310 if (i == 0) 311 break; 312 } 313 314 /* 315 * Warning: idat may point to garbage here, but 316 * we only use it in the while() loop, only if 317 * there are indeed enough data. 318 */ 319 idat = (char *)iov->iov_base + k; 320 321 while (iov->iov_len >= k + blks && i > 0) { 322 if (crd->crd_flags & CRD_F_ENCRYPT) { 323 /* XOR with previous block/IV */ 324 for (j = 0; j < blks; j++) 325 idat[j] ^= ivp[j]; 326 327 exf->encrypt(sw->sw_kschedule, idat); 328 ivp = idat; 329 } else { /* decrypt */ 330 /* 331 * Keep encrypted block to be used 332 * in next block's processing. 333 */ 334 if (ivp == iv) 335 bcopy(idat, piv, blks); 336 else 337 bcopy(idat, iv, blks); 338 339 exf->decrypt(sw->sw_kschedule, idat); 340 341 /* XOR with previous block/IV */ 342 for (j = 0; j < blks; j++) 343 idat[j] ^= ivp[j]; 344 345 if (ivp == iv) 346 bcopy(piv, iv, blks); 347 else 348 ivp = iv; 349 } 350 351 idat += blks; 352 k += blks; 353 i -= blks; 354 } 355 } 356 357 return 0; /* Done with iovec encryption/decryption */ 358 } else { /* contiguous buffer */ 359 if (crd->crd_flags & CRD_F_ENCRYPT) { 360 for (i = crd->crd_skip; 361 i < crd->crd_skip + crd->crd_len; i += blks) { 362 /* XOR with the IV/previous block, as appropriate. */ 363 if (i == crd->crd_skip) 364 for (k = 0; k < blks; k++) 365 buf[i + k] ^= ivp[k]; 366 else 367 for (k = 0; k < blks; k++) 368 buf[i + k] ^= buf[i + k - blks]; 369 exf->encrypt(sw->sw_kschedule, buf + i); 370 } 371 } else { /* Decrypt */ 372 /* 373 * Start at the end, so we don't need to keep the encrypted 374 * block as the IV for the next block. 375 */ 376 for (i = crd->crd_skip + crd->crd_len - blks; 377 i >= crd->crd_skip; i -= blks) { 378 exf->decrypt(sw->sw_kschedule, buf + i); 379 380 /* XOR with the IV/previous block, as appropriate */ 381 if (i == crd->crd_skip) 382 for (k = 0; k < blks; k++) 383 buf[i + k] ^= ivp[k]; 384 else 385 for (k = 0; k < blks; k++) 386 buf[i + k] ^= buf[i + k - blks]; 387 } 388 } 389 390 return 0; /* Done with contiguous buffer encryption/decryption */ 391 } 392 393 /* Unreachable */ 394 return EINVAL; 395 } 396 397 static void 398 swcr_authprepare(struct auth_hash *axf, struct swcr_data *sw, u_char *key, 399 int klen) 400 { 401 int k; 402 403 klen /= 8; 404 405 switch (axf->type) { 406 case CRYPTO_MD5_HMAC: 407 case CRYPTO_SHA1_HMAC: 408 case CRYPTO_SHA2_256_HMAC: 409 case CRYPTO_SHA2_384_HMAC: 410 case CRYPTO_SHA2_512_HMAC: 411 case CRYPTO_NULL_HMAC: 412 case CRYPTO_RIPEMD160_HMAC: 413 for (k = 0; k < klen; k++) 414 key[k] ^= HMAC_IPAD_VAL; 415 416 axf->Init(sw->sw_ictx); 417 axf->Update(sw->sw_ictx, key, klen); 418 axf->Update(sw->sw_ictx, hmac_ipad_buffer, axf->blocksize - klen); 419 420 for (k = 0; k < klen; k++) 421 key[k] ^= (HMAC_IPAD_VAL ^ HMAC_OPAD_VAL); 422 423 axf->Init(sw->sw_octx); 424 axf->Update(sw->sw_octx, key, klen); 425 axf->Update(sw->sw_octx, hmac_opad_buffer, axf->blocksize - klen); 426 427 for (k = 0; k < klen; k++) 428 key[k] ^= HMAC_OPAD_VAL; 429 break; 430 case CRYPTO_MD5_KPDK: 431 case CRYPTO_SHA1_KPDK: 432 { 433 /* 434 * We need a buffer that can hold an md5 and a sha1 result 435 * just to throw it away. 436 * What we do here is the initial part of: 437 * ALGO( key, keyfill, .. ) 438 * adding the key to sw_ictx and abusing Final() to get the 439 * "keyfill" padding. 440 * In addition we abuse the sw_octx to save the key to have 441 * it to be able to append it at the end in swcr_authcompute(). 442 */ 443 u_char buf[SHA1_RESULTLEN]; 444 445 sw->sw_klen = klen; 446 bcopy(key, sw->sw_octx, klen); 447 axf->Init(sw->sw_ictx); 448 axf->Update(sw->sw_ictx, key, klen); 449 axf->Final(buf, sw->sw_ictx); 450 break; 451 } 452 default: 453 printf("%s: CRD_F_KEY_EXPLICIT flag given, but algorithm %d " 454 "doesn't use keys.\n", __func__, axf->type); 455 } 456 } 457 458 /* 459 * Compute keyed-hash authenticator. 460 */ 461 static int 462 swcr_authcompute(struct cryptodesc *crd, struct swcr_data *sw, caddr_t buf, 463 int flags) 464 { 465 unsigned char aalg[HASH_MAX_LEN]; 466 struct auth_hash *axf; 467 union authctx ctx; 468 int err; 469 470 if (sw->sw_ictx == 0) 471 return EINVAL; 472 473 axf = sw->sw_axf; 474 475 if (crd->crd_flags & CRD_F_KEY_EXPLICIT) 476 swcr_authprepare(axf, sw, crd->crd_key, crd->crd_klen); 477 478 bcopy(sw->sw_ictx, &ctx, axf->ctxsize); 479 480 err = crypto_apply(flags, buf, crd->crd_skip, crd->crd_len, 481 (int (*)(void *, void *, unsigned int))axf->Update, (caddr_t)&ctx); 482 if (err) 483 return err; 484 485 switch (sw->sw_alg) { 486 case CRYPTO_MD5_HMAC: 487 case CRYPTO_SHA1_HMAC: 488 case CRYPTO_SHA2_256_HMAC: 489 case CRYPTO_SHA2_384_HMAC: 490 case CRYPTO_SHA2_512_HMAC: 491 case CRYPTO_RIPEMD160_HMAC: 492 if (sw->sw_octx == NULL) 493 return EINVAL; 494 495 axf->Final(aalg, &ctx); 496 bcopy(sw->sw_octx, &ctx, axf->ctxsize); 497 axf->Update(&ctx, aalg, axf->hashsize); 498 axf->Final(aalg, &ctx); 499 break; 500 501 case CRYPTO_MD5_KPDK: 502 case CRYPTO_SHA1_KPDK: 503 /* If we have no key saved, return error. */ 504 if (sw->sw_octx == NULL) 505 return EINVAL; 506 507 /* 508 * Add the trailing copy of the key (see comment in 509 * swcr_authprepare()) after the data: 510 * ALGO( .., key, algofill ) 511 * and let Final() do the proper, natural "algofill" 512 * padding. 513 */ 514 axf->Update(&ctx, sw->sw_octx, sw->sw_klen); 515 axf->Final(aalg, &ctx); 516 break; 517 518 case CRYPTO_NULL_HMAC: 519 axf->Final(aalg, &ctx); 520 break; 521 } 522 523 /* Inject the authentication data */ 524 crypto_copyback(flags, buf, crd->crd_inject, 525 sw->sw_mlen == 0 ? axf->hashsize : sw->sw_mlen, aalg); 526 return 0; 527 } 528 529 /* 530 * Apply a compression/decompression algorithm 531 */ 532 static int 533 swcr_compdec(struct cryptodesc *crd, struct swcr_data *sw, 534 caddr_t buf, int flags) 535 { 536 u_int8_t *data, *out; 537 struct comp_algo *cxf; 538 int adj; 539 u_int32_t result; 540 541 cxf = sw->sw_cxf; 542 543 /* We must handle the whole buffer of data in one time 544 * then if there is not all the data in the mbuf, we must 545 * copy in a buffer. 546 */ 547 548 MALLOC(data, u_int8_t *, crd->crd_len, M_CRYPTO_DATA, M_NOWAIT); 549 if (data == NULL) 550 return (EINVAL); 551 crypto_copydata(flags, buf, crd->crd_skip, crd->crd_len, data); 552 553 if (crd->crd_flags & CRD_F_COMP) 554 result = cxf->compress(data, crd->crd_len, &out); 555 else 556 result = cxf->decompress(data, crd->crd_len, &out); 557 558 FREE(data, M_CRYPTO_DATA); 559 if (result == 0) 560 return EINVAL; 561 562 /* Copy back the (de)compressed data. m_copyback is 563 * extending the mbuf as necessary. 564 */ 565 sw->sw_size = result; 566 /* Check the compressed size when doing compression */ 567 if (crd->crd_flags & CRD_F_COMP) { 568 if (result >= crd->crd_len) { 569 /* Compression was useless, we lost time */ 570 FREE(out, M_CRYPTO_DATA); 571 return 0; 572 } 573 } 574 575 crypto_copyback(flags, buf, crd->crd_skip, result, out); 576 if (result < crd->crd_len) { 577 adj = result - crd->crd_len; 578 if (flags & CRYPTO_F_IMBUF) { 579 adj = result - crd->crd_len; 580 m_adj((struct mbuf *)buf, adj); 581 } else if (flags & CRYPTO_F_IOV) { 582 struct uio *uio = (struct uio *)buf; 583 int ind; 584 585 adj = crd->crd_len - result; 586 ind = uio->uio_iovcnt - 1; 587 588 while (adj > 0 && ind >= 0) { 589 if (adj < uio->uio_iov[ind].iov_len) { 590 uio->uio_iov[ind].iov_len -= adj; 591 break; 592 } 593 594 adj -= uio->uio_iov[ind].iov_len; 595 uio->uio_iov[ind].iov_len = 0; 596 ind--; 597 uio->uio_iovcnt--; 598 } 599 } 600 } 601 FREE(out, M_CRYPTO_DATA); 602 return 0; 603 } 604 605 /* 606 * Generate a new software session. 607 */ 608 static int 609 swcr_newsession(device_t dev, u_int32_t *sid, struct cryptoini *cri) 610 { 611 struct swcr_data **swd; 612 struct auth_hash *axf; 613 struct enc_xform *txf; 614 struct comp_algo *cxf; 615 u_int32_t i; 616 int error; 617 618 if (sid == NULL || cri == NULL) 619 return EINVAL; 620 621 if (swcr_sessions) { 622 for (i = 1; i < swcr_sesnum; i++) 623 if (swcr_sessions[i] == NULL) 624 break; 625 } else 626 i = 1; /* NB: to silence compiler warning */ 627 628 if (swcr_sessions == NULL || i == swcr_sesnum) { 629 if (swcr_sessions == NULL) { 630 i = 1; /* We leave swcr_sessions[0] empty */ 631 swcr_sesnum = CRYPTO_SW_SESSIONS; 632 } else 633 swcr_sesnum *= 2; 634 635 swd = malloc(swcr_sesnum * sizeof(struct swcr_data *), 636 M_CRYPTO_DATA, M_NOWAIT|M_ZERO); 637 if (swd == NULL) { 638 /* Reset session number */ 639 if (swcr_sesnum == CRYPTO_SW_SESSIONS) 640 swcr_sesnum = 0; 641 else 642 swcr_sesnum /= 2; 643 return ENOBUFS; 644 } 645 646 /* Copy existing sessions */ 647 if (swcr_sessions != NULL) { 648 bcopy(swcr_sessions, swd, 649 (swcr_sesnum / 2) * sizeof(struct swcr_data *)); 650 free(swcr_sessions, M_CRYPTO_DATA); 651 } 652 653 swcr_sessions = swd; 654 } 655 656 swd = &swcr_sessions[i]; 657 *sid = i; 658 659 while (cri) { 660 MALLOC(*swd, struct swcr_data *, sizeof(struct swcr_data), 661 M_CRYPTO_DATA, M_NOWAIT|M_ZERO); 662 if (*swd == NULL) { 663 swcr_freesession(dev, i); 664 return ENOBUFS; 665 } 666 667 switch (cri->cri_alg) { 668 case CRYPTO_DES_CBC: 669 txf = &enc_xform_des; 670 goto enccommon; 671 case CRYPTO_3DES_CBC: 672 txf = &enc_xform_3des; 673 goto enccommon; 674 case CRYPTO_BLF_CBC: 675 txf = &enc_xform_blf; 676 goto enccommon; 677 case CRYPTO_CAST_CBC: 678 txf = &enc_xform_cast5; 679 goto enccommon; 680 case CRYPTO_SKIPJACK_CBC: 681 txf = &enc_xform_skipjack; 682 goto enccommon; 683 case CRYPTO_RIJNDAEL128_CBC: 684 txf = &enc_xform_rijndael128; 685 goto enccommon; 686 case CRYPTO_CAMELLIA_CBC: 687 txf = &enc_xform_camellia; 688 goto enccommon; 689 case CRYPTO_NULL_CBC: 690 txf = &enc_xform_null; 691 goto enccommon; 692 enccommon: 693 if (cri->cri_key != NULL) { 694 error = txf->setkey(&((*swd)->sw_kschedule), 695 cri->cri_key, cri->cri_klen / 8); 696 if (error) { 697 swcr_freesession(dev, i); 698 return error; 699 } 700 } 701 (*swd)->sw_exf = txf; 702 break; 703 704 case CRYPTO_MD5_HMAC: 705 axf = &auth_hash_hmac_md5; 706 goto authcommon; 707 case CRYPTO_SHA1_HMAC: 708 axf = &auth_hash_hmac_sha1; 709 goto authcommon; 710 case CRYPTO_SHA2_256_HMAC: 711 axf = &auth_hash_hmac_sha2_256; 712 goto authcommon; 713 case CRYPTO_SHA2_384_HMAC: 714 axf = &auth_hash_hmac_sha2_384; 715 goto authcommon; 716 case CRYPTO_SHA2_512_HMAC: 717 axf = &auth_hash_hmac_sha2_512; 718 goto authcommon; 719 case CRYPTO_NULL_HMAC: 720 axf = &auth_hash_null; 721 goto authcommon; 722 case CRYPTO_RIPEMD160_HMAC: 723 axf = &auth_hash_hmac_ripemd_160; 724 authcommon: 725 (*swd)->sw_ictx = malloc(axf->ctxsize, M_CRYPTO_DATA, 726 M_NOWAIT); 727 if ((*swd)->sw_ictx == NULL) { 728 swcr_freesession(dev, i); 729 return ENOBUFS; 730 } 731 732 (*swd)->sw_octx = malloc(axf->ctxsize, M_CRYPTO_DATA, 733 M_NOWAIT); 734 if ((*swd)->sw_octx == NULL) { 735 swcr_freesession(dev, i); 736 return ENOBUFS; 737 } 738 739 if (cri->cri_key != NULL) { 740 swcr_authprepare(axf, *swd, cri->cri_key, 741 cri->cri_klen); 742 } 743 744 (*swd)->sw_mlen = cri->cri_mlen; 745 (*swd)->sw_axf = axf; 746 break; 747 748 case CRYPTO_MD5_KPDK: 749 axf = &auth_hash_key_md5; 750 goto auth2common; 751 752 case CRYPTO_SHA1_KPDK: 753 axf = &auth_hash_key_sha1; 754 auth2common: 755 (*swd)->sw_ictx = malloc(axf->ctxsize, M_CRYPTO_DATA, 756 M_NOWAIT); 757 if ((*swd)->sw_ictx == NULL) { 758 swcr_freesession(dev, i); 759 return ENOBUFS; 760 } 761 762 (*swd)->sw_octx = malloc(cri->cri_klen / 8, 763 M_CRYPTO_DATA, M_NOWAIT); 764 if ((*swd)->sw_octx == NULL) { 765 swcr_freesession(dev, i); 766 return ENOBUFS; 767 } 768 769 /* Store the key so we can "append" it to the payload */ 770 if (cri->cri_key != NULL) { 771 swcr_authprepare(axf, *swd, cri->cri_key, 772 cri->cri_klen); 773 } 774 775 (*swd)->sw_mlen = cri->cri_mlen; 776 (*swd)->sw_axf = axf; 777 break; 778 #ifdef notdef 779 case CRYPTO_MD5: 780 axf = &auth_hash_md5; 781 goto auth3common; 782 783 case CRYPTO_SHA1: 784 axf = &auth_hash_sha1; 785 auth3common: 786 (*swd)->sw_ictx = malloc(axf->ctxsize, M_CRYPTO_DATA, 787 M_NOWAIT); 788 if ((*swd)->sw_ictx == NULL) { 789 swcr_freesession(dev, i); 790 return ENOBUFS; 791 } 792 793 axf->Init((*swd)->sw_ictx); 794 (*swd)->sw_mlen = cri->cri_mlen; 795 (*swd)->sw_axf = axf; 796 break; 797 #endif 798 case CRYPTO_DEFLATE_COMP: 799 cxf = &comp_algo_deflate; 800 (*swd)->sw_cxf = cxf; 801 break; 802 default: 803 swcr_freesession(dev, i); 804 return EINVAL; 805 } 806 807 (*swd)->sw_alg = cri->cri_alg; 808 cri = cri->cri_next; 809 swd = &((*swd)->sw_next); 810 } 811 return 0; 812 } 813 814 /* 815 * Free a session. 816 */ 817 static int 818 swcr_freesession(device_t dev, u_int64_t tid) 819 { 820 struct swcr_data *swd; 821 struct enc_xform *txf; 822 struct auth_hash *axf; 823 struct comp_algo *cxf; 824 u_int32_t sid = CRYPTO_SESID2LID(tid); 825 826 if (sid > swcr_sesnum || swcr_sessions == NULL || 827 swcr_sessions[sid] == NULL) 828 return EINVAL; 829 830 /* Silently accept and return */ 831 if (sid == 0) 832 return 0; 833 834 while ((swd = swcr_sessions[sid]) != NULL) { 835 swcr_sessions[sid] = swd->sw_next; 836 837 switch (swd->sw_alg) { 838 case CRYPTO_DES_CBC: 839 case CRYPTO_3DES_CBC: 840 case CRYPTO_BLF_CBC: 841 case CRYPTO_CAST_CBC: 842 case CRYPTO_SKIPJACK_CBC: 843 case CRYPTO_RIJNDAEL128_CBC: 844 case CRYPTO_CAMELLIA_CBC: 845 case CRYPTO_NULL_CBC: 846 txf = swd->sw_exf; 847 848 if (swd->sw_kschedule) 849 txf->zerokey(&(swd->sw_kschedule)); 850 break; 851 852 case CRYPTO_MD5_HMAC: 853 case CRYPTO_SHA1_HMAC: 854 case CRYPTO_SHA2_256_HMAC: 855 case CRYPTO_SHA2_384_HMAC: 856 case CRYPTO_SHA2_512_HMAC: 857 case CRYPTO_RIPEMD160_HMAC: 858 case CRYPTO_NULL_HMAC: 859 axf = swd->sw_axf; 860 861 if (swd->sw_ictx) { 862 bzero(swd->sw_ictx, axf->ctxsize); 863 free(swd->sw_ictx, M_CRYPTO_DATA); 864 } 865 if (swd->sw_octx) { 866 bzero(swd->sw_octx, axf->ctxsize); 867 free(swd->sw_octx, M_CRYPTO_DATA); 868 } 869 break; 870 871 case CRYPTO_MD5_KPDK: 872 case CRYPTO_SHA1_KPDK: 873 axf = swd->sw_axf; 874 875 if (swd->sw_ictx) { 876 bzero(swd->sw_ictx, axf->ctxsize); 877 free(swd->sw_ictx, M_CRYPTO_DATA); 878 } 879 if (swd->sw_octx) { 880 bzero(swd->sw_octx, swd->sw_klen); 881 free(swd->sw_octx, M_CRYPTO_DATA); 882 } 883 break; 884 885 case CRYPTO_MD5: 886 case CRYPTO_SHA1: 887 axf = swd->sw_axf; 888 889 if (swd->sw_ictx) 890 free(swd->sw_ictx, M_CRYPTO_DATA); 891 break; 892 893 case CRYPTO_DEFLATE_COMP: 894 cxf = swd->sw_cxf; 895 break; 896 } 897 898 FREE(swd, M_CRYPTO_DATA); 899 } 900 return 0; 901 } 902 903 /* 904 * Process a software request. 905 */ 906 static int 907 swcr_process(device_t dev, struct cryptop *crp, int hint) 908 { 909 struct cryptodesc *crd; 910 struct swcr_data *sw; 911 u_int32_t lid; 912 913 /* Sanity check */ 914 if (crp == NULL) 915 return EINVAL; 916 917 if (crp->crp_desc == NULL || crp->crp_buf == NULL) { 918 crp->crp_etype = EINVAL; 919 goto done; 920 } 921 922 lid = crp->crp_sid & 0xffffffff; 923 if (lid >= swcr_sesnum || lid == 0 || swcr_sessions[lid] == NULL) { 924 crp->crp_etype = ENOENT; 925 goto done; 926 } 927 928 /* Go through crypto descriptors, processing as we go */ 929 for (crd = crp->crp_desc; crd; crd = crd->crd_next) { 930 /* 931 * Find the crypto context. 932 * 933 * XXX Note that the logic here prevents us from having 934 * XXX the same algorithm multiple times in a session 935 * XXX (or rather, we can but it won't give us the right 936 * XXX results). To do that, we'd need some way of differentiating 937 * XXX between the various instances of an algorithm (so we can 938 * XXX locate the correct crypto context). 939 */ 940 for (sw = swcr_sessions[lid]; 941 sw && sw->sw_alg != crd->crd_alg; 942 sw = sw->sw_next) 943 ; 944 945 /* No such context ? */ 946 if (sw == NULL) { 947 crp->crp_etype = EINVAL; 948 goto done; 949 } 950 switch (sw->sw_alg) { 951 case CRYPTO_DES_CBC: 952 case CRYPTO_3DES_CBC: 953 case CRYPTO_BLF_CBC: 954 case CRYPTO_CAST_CBC: 955 case CRYPTO_SKIPJACK_CBC: 956 case CRYPTO_RIJNDAEL128_CBC: 957 case CRYPTO_CAMELLIA_CBC: 958 if ((crp->crp_etype = swcr_encdec(crd, sw, 959 crp->crp_buf, crp->crp_flags)) != 0) 960 goto done; 961 break; 962 case CRYPTO_NULL_CBC: 963 crp->crp_etype = 0; 964 break; 965 case CRYPTO_MD5_HMAC: 966 case CRYPTO_SHA1_HMAC: 967 case CRYPTO_SHA2_256_HMAC: 968 case CRYPTO_SHA2_384_HMAC: 969 case CRYPTO_SHA2_512_HMAC: 970 case CRYPTO_RIPEMD160_HMAC: 971 case CRYPTO_NULL_HMAC: 972 case CRYPTO_MD5_KPDK: 973 case CRYPTO_SHA1_KPDK: 974 case CRYPTO_MD5: 975 case CRYPTO_SHA1: 976 if ((crp->crp_etype = swcr_authcompute(crd, sw, 977 crp->crp_buf, crp->crp_flags)) != 0) 978 goto done; 979 break; 980 981 case CRYPTO_DEFLATE_COMP: 982 if ((crp->crp_etype = swcr_compdec(crd, sw, 983 crp->crp_buf, crp->crp_flags)) != 0) 984 goto done; 985 else 986 crp->crp_olen = (int)sw->sw_size; 987 break; 988 989 default: 990 /* Unknown/unsupported algorithm */ 991 crp->crp_etype = EINVAL; 992 goto done; 993 } 994 } 995 996 done: 997 crypto_done(crp); 998 return 0; 999 } 1000 1001 static void 1002 swcr_identify(device_t *dev, device_t parent) 1003 { 1004 /* NB: order 10 is so we get attached after h/w devices */ 1005 if (device_find_child(parent, "cryptosoft", -1) == NULL && 1006 BUS_ADD_CHILD(parent, 10, "cryptosoft", 0) == 0) 1007 panic("cryptosoft: could not attach"); 1008 } 1009 1010 static int 1011 swcr_probe(device_t dev) 1012 { 1013 device_set_desc(dev, "software crypto"); 1014 return (BUS_PROBE_NOWILDCARD); 1015 } 1016 1017 static int 1018 swcr_attach(device_t dev) 1019 { 1020 memset(hmac_ipad_buffer, HMAC_IPAD_VAL, HMAC_MAX_BLOCK_LEN); 1021 memset(hmac_opad_buffer, HMAC_OPAD_VAL, HMAC_MAX_BLOCK_LEN); 1022 1023 swcr_id = crypto_get_driverid(dev, 1024 CRYPTOCAP_F_SOFTWARE | CRYPTOCAP_F_SYNC); 1025 if (swcr_id < 0) { 1026 device_printf(dev, "cannot initialize!"); 1027 return ENOMEM; 1028 } 1029 #define REGISTER(alg) \ 1030 crypto_register(swcr_id, alg, 0,0) 1031 REGISTER(CRYPTO_DES_CBC); 1032 REGISTER(CRYPTO_3DES_CBC); 1033 REGISTER(CRYPTO_BLF_CBC); 1034 REGISTER(CRYPTO_CAST_CBC); 1035 REGISTER(CRYPTO_SKIPJACK_CBC); 1036 REGISTER(CRYPTO_NULL_CBC); 1037 REGISTER(CRYPTO_MD5_HMAC); 1038 REGISTER(CRYPTO_SHA1_HMAC); 1039 REGISTER(CRYPTO_SHA2_256_HMAC); 1040 REGISTER(CRYPTO_SHA2_384_HMAC); 1041 REGISTER(CRYPTO_SHA2_512_HMAC); 1042 REGISTER(CRYPTO_RIPEMD160_HMAC); 1043 REGISTER(CRYPTO_NULL_HMAC); 1044 REGISTER(CRYPTO_MD5_KPDK); 1045 REGISTER(CRYPTO_SHA1_KPDK); 1046 REGISTER(CRYPTO_MD5); 1047 REGISTER(CRYPTO_SHA1); 1048 REGISTER(CRYPTO_RIJNDAEL128_CBC); 1049 REGISTER(CRYPTO_CAMELLIA_CBC); 1050 REGISTER(CRYPTO_DEFLATE_COMP); 1051 #undef REGISTER 1052 1053 return 0; 1054 } 1055 1056 static void 1057 swcr_detach(device_t dev) 1058 { 1059 crypto_unregister_all(swcr_id); 1060 if (swcr_sessions != NULL) 1061 FREE(swcr_sessions, M_CRYPTO_DATA); 1062 } 1063 1064 static device_method_t swcr_methods[] = { 1065 DEVMETHOD(device_identify, swcr_identify), 1066 DEVMETHOD(device_probe, swcr_probe), 1067 DEVMETHOD(device_attach, swcr_attach), 1068 DEVMETHOD(device_detach, swcr_detach), 1069 1070 DEVMETHOD(cryptodev_newsession, swcr_newsession), 1071 DEVMETHOD(cryptodev_freesession,swcr_freesession), 1072 DEVMETHOD(cryptodev_process, swcr_process), 1073 1074 {0, 0}, 1075 }; 1076 1077 static driver_t swcr_driver = { 1078 "cryptosoft", 1079 swcr_methods, 1080 0, /* NB: no softc */ 1081 }; 1082 static devclass_t swcr_devclass; 1083 1084 /* 1085 * NB: We explicitly reference the crypto module so we 1086 * get the necessary ordering when built as a loadable 1087 * module. This is required because we bundle the crypto 1088 * module code together with the cryptosoft driver (otherwise 1089 * normal module dependencies would handle things). 1090 */ 1091 extern int crypto_modevent(struct module *, int, void *); 1092 /* XXX where to attach */ 1093 DRIVER_MODULE(cryptosoft, nexus, swcr_driver, swcr_devclass, crypto_modevent,0); 1094 MODULE_VERSION(cryptosoft, 1); 1095 MODULE_DEPEND(cryptosoft, crypto, 1, 1, 1);
Cache object: 4c81ace70bccdf648ff852e0c66085e3
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]