Page MenuHomeFreeBSD
Differential D24542

Extend support in sysctls for supporting multiple native ABIs.
ClosedPublic
Actions

Authored by jhb on Apr 22 2020, 9:11 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Mar 23, 12:23 PM
Unknown Object (File)
Wed, Mar 12, 7:27 PM
Unknown Object (File)
Mon, Mar 10, 7:56 AM
Unknown Object (File)
Tue, Mar 4, 8:13 PM
Unknown Object (File)
Feb 22 2025, 3:09 AM
Unknown Object (File)
Feb 22 2025, 2:45 AM
Unknown Object (File)
Feb 21 2025, 10:16 PM
Unknown Object (File)
Jan 30 2025, 6:37 AM
View All 83 Files
Subscribers
None

Details

Reviewers
imp
kp
Commits
rS360386: Extend support in sysctls for supporting multiple native ABIs.
Summary

This extends some of the changes in place to support reporting support
for 32-bit ABIs to permit reporting hard-float vs soft-float ABIs.

Test Plan
  • tested with RISC-V

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Revision Contents
Changeset List

PathSize
head/
sys/
kern/
39 lines
sys/
2 lines

Diff 71069

View Options

head/sys/kern/kern_mib.c

Show First 20 Lines • Show All 101 Lines • ▼ Show 20 Lines
*/ */
static int static int
swcr_encdec(struct swcr_session *ses, struct cryptop *crp) swcr_encdec(struct swcr_session *ses, struct cryptop *crp)
{ {
unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN]; unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN];
unsigned char *ivp, *nivp, iv2[EALG_MAX_BLOCK_LEN]; unsigned char *ivp, *nivp, iv2[EALG_MAX_BLOCK_LEN];
const struct crypto_session_params *csp; const struct crypto_session_params *csp;
const struct enc_xform *exf; const struct enc_xform *exf;
struct swcr_encdec *sw; const struct swcr_encdec *sw;
void *ctx;
markjUnsubmitted
Done
Inline Actions

Make sw a pointer to const?

markj: Make `sw` a pointer to const?
jhbAuthorUnsubmitted
Done
Inline Actions

Oh, that's a good idea, yes.

jhb: Oh, that's a good idea, yes.
size_t inlen, outlen; size_t inlen, outlen;
int i, blks, resid; int i, blks, resid;
struct crypto_buffer_cursor cc_in, cc_out; struct crypto_buffer_cursor cc_in, cc_out;
const unsigned char *inblk; const unsigned char *inblk;
unsigned char *outblk; unsigned char *outblk;
int error; int error;
bool encrypting; bool encrypting;
Show All 11 Lines if (exf->native_blocksize == 0) {
blks = exf->blocksize; blks = exf->blocksize;
} else } else
blks = exf->native_blocksize; blks = exf->native_blocksize;
if (exf == &enc_xform_aes_icm && if (exf == &enc_xform_aes_icm &&
(crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0) (crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
return (EINVAL); return (EINVAL);
ctx = __builtin_alloca(exf->ctxsize);
if (crp->crp_cipher_key != NULL) { if (crp->crp_cipher_key != NULL) {
error = exf->setkey(sw->sw_ctx, error = exf->setkey(ctx, crp->crp_cipher_key,
crp->crp_cipher_key, csp->csp_cipher_klen); csp->csp_cipher_klen);
if (error) if (error)
return (error); return (error);
} } else
memcpy(ctx, sw->sw_ctx, exf->ctxsize);
crypto_read_iv(crp, iv); crypto_read_iv(crp, iv);
if (exf->reinit) { if (exf->reinit) {
/* /*
* xforms that provide a reinit method perform all IV * xforms that provide a reinit method perform all IV
* handling themselves. * handling themselves.
*/ */
exf->reinit(sw->sw_ctx, iv, csp->csp_ivlen); exf->reinit(ctx, iv, csp->csp_ivlen);
} }
ivp = iv; ivp = iv;
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_payload_start); crypto_cursor_advance(&cc_in, crp->crp_payload_start);
inblk = crypto_cursor_segment(&cc_in, &inlen); inblk = crypto_cursor_segment(&cc_in, &inlen);
if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) { if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
Show All 26 Lines if (outlen < blks)
outblk = blk; outblk = blk;
/* /*
* Ciphers without a 'reinit' hook are assumed to be * Ciphers without a 'reinit' hook are assumed to be
* used in CBC mode where the chaining is done here. * used in CBC mode where the chaining is done here.
*/ */
if (exf->reinit != NULL) { if (exf->reinit != NULL) {
if (encrypting) if (encrypting)
exf->encrypt(sw->sw_ctx, inblk, outblk); exf->encrypt(ctx, inblk, outblk);
else else
exf->decrypt(sw->sw_ctx, inblk, outblk); exf->decrypt(ctx, inblk, outblk);
} else if (encrypting) { } else if (encrypting) {
/* XOR with previous block */ /* XOR with previous block */
for (i = 0; i < blks; i++) for (i = 0; i < blks; i++)
outblk[i] = inblk[i] ^ ivp[i]; outblk[i] = inblk[i] ^ ivp[i];
exf->encrypt(sw->sw_ctx, outblk, outblk); exf->encrypt(ctx, outblk, outblk);
/* /*
* Keep encrypted block for XOR'ing * Keep encrypted block for XOR'ing
* with next block * with next block
*/ */
memcpy(iv, outblk, blks); memcpy(iv, outblk, blks);
ivp = iv; ivp = iv;
} else { /* decrypt */ } else { /* decrypt */
/* /*
* Keep encrypted block for XOR'ing * Keep encrypted block for XOR'ing
* with next block * with next block
*/ */
nivp = (ivp == iv) ? iv2 : iv; nivp = (ivp == iv) ? iv2 : iv;
memcpy(nivp, inblk, blks); memcpy(nivp, inblk, blks);
exf->decrypt(sw->sw_ctx, inblk, outblk); exf->decrypt(ctx, inblk, outblk);
/* XOR with previous block */ /* XOR with previous block */
for (i = 0; i < blks; i++) for (i = 0; i < blks; i++)
outblk[i] ^= ivp[i]; outblk[i] ^= ivp[i];
ivp = nivp; ivp = nivp;
} }
Show All 31 Lines if (resid > 0) {
outblk = crypto_cursor_segment(&cc_out, &outlen); outblk = crypto_cursor_segment(&cc_out, &outlen);
if (inlen < resid) { if (inlen < resid) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
inblk = blk; inblk = blk;
} }
if (outlen < resid) if (outlen < resid)
outblk = blk; outblk = blk;
if (encrypting) if (encrypting)
exf->encrypt_last(sw->sw_ctx, inblk, outblk, exf->encrypt_last(ctx, inblk, outblk,
resid); resid);
else else
exf->decrypt_last(sw->sw_ctx, inblk, outblk, exf->decrypt_last(ctx, inblk, outblk,
resid); resid);
if (outlen < resid) if (outlen < resid)
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
explicit_bzero(ctx, exf->ctxsize);
explicit_bzero(blk, sizeof(blk)); explicit_bzero(blk, sizeof(blk));
explicit_bzero(iv, sizeof(iv)); explicit_bzero(iv, sizeof(iv));
explicit_bzero(iv2, sizeof(iv2)); explicit_bzero(iv2, sizeof(iv2));
return (0); return (0);
} }
static void static void
swcr_authprepare(const struct auth_hash *axf, struct swcr_auth *sw, swcr_authprepare(const struct auth_hash *axf, struct swcr_auth *sw,
▲ Show 20 Lines • Show All 177 Lines • ▼ Show 20 Lines
swcr_gcm(struct swcr_session *ses, struct cryptop *crp) swcr_gcm(struct swcr_session *ses, struct cryptop *crp)
{ {
uint32_t blkbuf[howmany(AES_BLOCK_LEN, sizeof(uint32_t))]; uint32_t blkbuf[howmany(AES_BLOCK_LEN, sizeof(uint32_t))];
u_char *blk = (u_char *)blkbuf; u_char *blk = (u_char *)blkbuf;
u_char tag[GMAC_DIGEST_LEN]; u_char tag[GMAC_DIGEST_LEN];
struct crypto_buffer_cursor cc_in, cc_out; struct crypto_buffer_cursor cc_in, cc_out;
const u_char *inblk; const u_char *inblk;
u_char *outblk; u_char *outblk;
struct swcr_auth *swa; const struct swcr_auth *swa;
struct swcr_encdec *swe; const struct swcr_encdec *swe;
markjUnsubmitted
Done
Inline Actions

Can swe and swa be declared const now?

markj: Can `swe` and `swa` be declared const now?
const struct enc_xform *exf; const struct enc_xform *exf;
void *ctx;
uint32_t *blkp; uint32_t *blkp;
size_t len; size_t len;
int blksz, error, ivlen, r, resid; int blksz, error, ivlen, r, resid;
swa = &ses->swcr_auth; swa = &ses->swcr_auth;
swe = &ses->swcr_encdec; swe = &ses->swcr_encdec;
exf = swe->sw_exf; exf = swe->sw_exf;
blksz = GMAC_BLOCK_LEN; blksz = GMAC_BLOCK_LEN;
KASSERT(blksz == exf->native_blocksize, KASSERT(blksz == exf->native_blocksize,
("%s: blocksize mismatch", __func__)); ("%s: blocksize mismatch", __func__));
if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0) if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
return (EINVAL); return (EINVAL);
ivlen = AES_GCM_IV_LEN; ivlen = AES_GCM_IV_LEN;
/* Supply cipher with nonce. */ ctx = __builtin_alloca(exf->ctxsize);
if (crp->crp_cipher_key != NULL) if (crp->crp_cipher_key != NULL)
exf->setkey(swe->sw_ctx, crp->crp_cipher_key, exf->setkey(ctx, crp->crp_cipher_key,
crypto_get_params(crp->crp_session)->csp_cipher_klen); crypto_get_params(crp->crp_session)->csp_cipher_klen);
exf->reinit(swe->sw_ctx, crp->crp_iv, ivlen); else
memcpy(ctx, swe->sw_ctx, exf->ctxsize);
exf->reinit(ctx, crp->crp_iv, ivlen);
/* Supply MAC with AAD */ /* Supply MAC with AAD */
if (crp->crp_aad != NULL) { if (crp->crp_aad != NULL) {
len = rounddown(crp->crp_aad_length, blksz); len = rounddown(crp->crp_aad_length, blksz);
if (len != 0) if (len != 0)
exf->update(swe->sw_ctx, crp->crp_aad, len); exf->update(ctx, crp->crp_aad, len);
if (crp->crp_aad_length != len) { if (crp->crp_aad_length != len) {
memset(blk, 0, blksz); memset(blk, 0, blksz);
memcpy(blk, (char *)crp->crp_aad + len, memcpy(blk, (char *)crp->crp_aad + len,
crp->crp_aad_length - len); crp->crp_aad_length - len);
exf->update(swe->sw_ctx, blk, blksz); exf->update(ctx, blk, blksz);
} }
} else { } else {
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_aad_start); crypto_cursor_advance(&cc_in, crp->crp_aad_start);
for (resid = crp->crp_aad_length; resid >= blksz; for (resid = crp->crp_aad_length; resid >= blksz;
resid -= len) { resid -= len) {
inblk = crypto_cursor_segment(&cc_in, &len); inblk = crypto_cursor_segment(&cc_in, &len);
if (len >= blksz) { if (len >= blksz) {
len = rounddown(MIN(len, resid), blksz); len = rounddown(MIN(len, resid), blksz);
crypto_cursor_advance(&cc_in, len); crypto_cursor_advance(&cc_in, len);
} else { } else {
len = blksz; len = blksz;
crypto_cursor_copydata(&cc_in, len, blk); crypto_cursor_copydata(&cc_in, len, blk);
inblk = blk; inblk = blk;
} }
exf->update(swe->sw_ctx, inblk, len); exf->update(ctx, inblk, len);
} }
if (resid > 0) { if (resid > 0) {
memset(blk, 0, blksz); memset(blk, 0, blksz);
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
exf->update(swe->sw_ctx, blk, blksz); exf->update(ctx, blk, blksz);
} }
} }
/* Do encryption with MAC */ /* Do encryption with MAC */
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_payload_start); crypto_cursor_advance(&cc_in, crp->crp_payload_start);
if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) { if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
crypto_cursor_init(&cc_out, &crp->crp_obuf); crypto_cursor_init(&cc_out, &crp->crp_obuf);
crypto_cursor_advance(&cc_out, crp->crp_payload_output_start); crypto_cursor_advance(&cc_out, crp->crp_payload_output_start);
} else } else
cc_out = cc_in; cc_out = cc_in;
for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) { for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) {
inblk = crypto_cursor_segment(&cc_in, &len); inblk = crypto_cursor_segment(&cc_in, &len);
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else { } else {
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
} }
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->encrypt(swe->sw_ctx, inblk, outblk); exf->encrypt(ctx, inblk, outblk);
exf->update(swe->sw_ctx, outblk, blksz); exf->update(ctx, outblk, blksz);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} else { } else {
exf->update(swe->sw_ctx, inblk, blksz); exf->update(ctx, inblk, blksz);
} }
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
exf->encrypt_last(swe->sw_ctx, blk, blk, resid); exf->encrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
exf->update(swe->sw_ctx, blk, resid); exf->update(ctx, blk, resid);
} }
/* length block */ /* length block */
memset(blk, 0, blksz); memset(blk, 0, blksz);
blkp = (uint32_t *)blk + 1; blkp = (uint32_t *)blk + 1;
*blkp = htobe32(crp->crp_aad_length * 8); *blkp = htobe32(crp->crp_aad_length * 8);
blkp = (uint32_t *)blk + 3; blkp = (uint32_t *)blk + 3;
*blkp = htobe32(crp->crp_payload_length * 8); *blkp = htobe32(crp->crp_payload_length * 8);
exf->update(swe->sw_ctx, blk, blksz); exf->update(ctx, blk, blksz);
/* Finalize MAC */ /* Finalize MAC */
exf->final(tag, swe->sw_ctx); exf->final(tag, ctx);
/* Validate tag */ /* Validate tag */
error = 0; error = 0;
if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
u_char tag2[GMAC_DIGEST_LEN]; u_char tag2[GMAC_DIGEST_LEN];
crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, tag2); crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, tag2);
Show All 13 Lines for (resid = crp->crp_payload_length; resid > blksz;
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else } else
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->decrypt(swe->sw_ctx, inblk, outblk); exf->decrypt(ctx, inblk, outblk);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
exf->decrypt_last(swe->sw_ctx, blk, blk, resid); exf->decrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
} else { } else {
/* Inject the authentication data */ /* Inject the authentication data */
crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag); crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag);
} }
out: out:
explicit_bzero(ctx, exf->ctxsize);
explicit_bzero(blkbuf, sizeof(blkbuf)); explicit_bzero(blkbuf, sizeof(blkbuf));
explicit_bzero(tag, sizeof(tag)); explicit_bzero(tag, sizeof(tag));
return (error); return (error);
} }
static void static void
build_ccm_b0(const char *nonce, u_int nonce_length, u_int aad_length, build_ccm_b0(const char *nonce, u_int nonce_length, u_int aad_length,
▲ Show 20 Lines • Show All 110 Lines • ▼ Show 20 Lines
{ {
const struct crypto_session_params *csp; const struct crypto_session_params *csp;
uint32_t blkbuf[howmany(AES_BLOCK_LEN, sizeof(uint32_t))]; uint32_t blkbuf[howmany(AES_BLOCK_LEN, sizeof(uint32_t))];
u_char *blk = (u_char *)blkbuf; u_char *blk = (u_char *)blkbuf;
u_char tag[AES_CBC_MAC_HASH_LEN]; u_char tag[AES_CBC_MAC_HASH_LEN];
struct crypto_buffer_cursor cc_in, cc_out; struct crypto_buffer_cursor cc_in, cc_out;
const u_char *inblk; const u_char *inblk;
u_char *outblk; u_char *outblk;
struct swcr_auth *swa; const struct swcr_auth *swa;
struct swcr_encdec *swe; const struct swcr_encdec *swe;
const struct enc_xform *exf; const struct enc_xform *exf;
void *ctx;
size_t len; size_t len;
int blksz, error, ivlen, r, resid; int blksz, error, ivlen, r, resid;
csp = crypto_get_params(crp->crp_session); csp = crypto_get_params(crp->crp_session);
swa = &ses->swcr_auth; swa = &ses->swcr_auth;
swe = &ses->swcr_encdec; swe = &ses->swcr_encdec;
exf = swe->sw_exf; exf = swe->sw_exf;
blksz = AES_BLOCK_LEN; blksz = AES_BLOCK_LEN;
KASSERT(blksz == exf->native_blocksize, KASSERT(blksz == exf->native_blocksize,
("%s: blocksize mismatch", __func__)); ("%s: blocksize mismatch", __func__));
if (crp->crp_payload_length > ccm_max_payload_length(csp)) if (crp->crp_payload_length > ccm_max_payload_length(csp))
return (EMSGSIZE); return (EMSGSIZE);
if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0) if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
return (EINVAL); return (EINVAL);
ivlen = csp->csp_ivlen; ivlen = csp->csp_ivlen;
ctx = __builtin_alloca(exf->ctxsize);
if (crp->crp_cipher_key != NULL) if (crp->crp_cipher_key != NULL)
exf->setkey(swe->sw_ctx, crp->crp_cipher_key, exf->setkey(ctx, crp->crp_cipher_key,
crypto_get_params(crp->crp_session)->csp_cipher_klen); crypto_get_params(crp->crp_session)->csp_cipher_klen);
exf->reinit(swe->sw_ctx, crp->crp_iv, ivlen); else
memcpy(ctx, swe->sw_ctx, exf->ctxsize);
exf->reinit(ctx, crp->crp_iv, ivlen);
/* Supply MAC with b0. */ /* Supply MAC with b0. */
_Static_assert(sizeof(blkbuf) >= CCM_CBC_BLOCK_LEN, _Static_assert(sizeof(blkbuf) >= CCM_CBC_BLOCK_LEN,
"blkbuf too small for b0"); "blkbuf too small for b0");
build_ccm_b0(crp->crp_iv, ivlen, crp->crp_aad_length, build_ccm_b0(crp->crp_iv, ivlen, crp->crp_aad_length,
crp->crp_payload_length, swa->sw_mlen, blk); crp->crp_payload_length, swa->sw_mlen, blk);
exf->update(swe->sw_ctx, blk, CCM_CBC_BLOCK_LEN); exf->update(ctx, blk, CCM_CBC_BLOCK_LEN);
/* Supply MAC with AAD */ /* Supply MAC with AAD */
if (crp->crp_aad_length != 0) { if (crp->crp_aad_length != 0) {
len = build_ccm_aad_length(crp->crp_aad_length, blk); len = build_ccm_aad_length(crp->crp_aad_length, blk);
exf->update(swe->sw_ctx, blk, len); exf->update(ctx, blk, len);
if (crp->crp_aad != NULL) if (crp->crp_aad != NULL)
exf->update(swe->sw_ctx, crp->crp_aad, exf->update(ctx, crp->crp_aad, crp->crp_aad_length);
crp->crp_aad_length);
else else
crypto_apply(crp, crp->crp_aad_start, crypto_apply(crp, crp->crp_aad_start,
crp->crp_aad_length, exf->update, crp->crp_aad_length, exf->update, ctx);
swe->sw_ctx);
/* Pad the AAD (including length field) to a full block. */ /* Pad the AAD (including length field) to a full block. */
len = (len + crp->crp_aad_length) % CCM_CBC_BLOCK_LEN; len = (len + crp->crp_aad_length) % CCM_CBC_BLOCK_LEN;
if (len != 0) { if (len != 0) {
len = CCM_CBC_BLOCK_LEN - len; len = CCM_CBC_BLOCK_LEN - len;
memset(blk, 0, CCM_CBC_BLOCK_LEN); memset(blk, 0, CCM_CBC_BLOCK_LEN);
exf->update(swe->sw_ctx, blk, len); exf->update(ctx, blk, len);
} }
} }
/* Do encryption/decryption with MAC */ /* Do encryption/decryption with MAC */
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_payload_start); crypto_cursor_advance(&cc_in, crp->crp_payload_start);
if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) { if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
crypto_cursor_init(&cc_out, &crp->crp_obuf); crypto_cursor_init(&cc_out, &crp->crp_obuf);
crypto_cursor_advance(&cc_out, crp->crp_payload_output_start); crypto_cursor_advance(&cc_out, crp->crp_payload_output_start);
} else } else
cc_out = cc_in; cc_out = cc_in;
for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) { for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) {
inblk = crypto_cursor_segment(&cc_in, &len); inblk = crypto_cursor_segment(&cc_in, &len);
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else } else
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->update(swe->sw_ctx, inblk, blksz); exf->update(ctx, inblk, blksz);
exf->encrypt(swe->sw_ctx, inblk, outblk); exf->encrypt(ctx, inblk, outblk);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} else { } else {
/* /*
* One of the problems with CCM+CBC is that * One of the problems with CCM+CBC is that
* the authentication is done on the * the authentication is done on the
* unencrypted data. As a result, we have to * unencrypted data. As a result, we have to
* decrypt the data twice: once to generate * decrypt the data twice: once to generate
* the tag and a second time after the tag is * the tag and a second time after the tag is
* verified. * verified.
*/ */
exf->decrypt(swe->sw_ctx, inblk, blk); exf->decrypt(ctx, inblk, blk);
exf->update(swe->sw_ctx, blk, blksz); exf->update(ctx, blk, blksz);
} }
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
exf->update(swe->sw_ctx, blk, resid); exf->update(ctx, blk, resid);
exf->encrypt_last(swe->sw_ctx, blk, blk, resid); exf->encrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} else { } else {
exf->decrypt_last(swe->sw_ctx, blk, blk, resid); exf->decrypt_last(ctx, blk, blk, resid);
exf->update(swe->sw_ctx, blk, resid); exf->update(ctx, blk, resid);
} }
} }
/* Finalize MAC */ /* Finalize MAC */
exf->final(tag, swe->sw_ctx); exf->final(tag, ctx);
/* Validate tag */ /* Validate tag */
error = 0; error = 0;
if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
u_char tag2[AES_CBC_MAC_HASH_LEN]; u_char tag2[AES_CBC_MAC_HASH_LEN];
crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen,
tag2); tag2);
r = timingsafe_bcmp(tag, tag2, swa->sw_mlen); r = timingsafe_bcmp(tag, tag2, swa->sw_mlen);
explicit_bzero(tag2, sizeof(tag2)); explicit_bzero(tag2, sizeof(tag2));
if (r != 0) { if (r != 0) {
error = EBADMSG; error = EBADMSG;
goto out; goto out;
} }
/* tag matches, decrypt data */ /* tag matches, decrypt data */
exf->reinit(swe->sw_ctx, crp->crp_iv, ivlen); exf->reinit(ctx, crp->crp_iv, ivlen);
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_payload_start); crypto_cursor_advance(&cc_in, crp->crp_payload_start);
for (resid = crp->crp_payload_length; resid > blksz; for (resid = crp->crp_payload_length; resid > blksz;
resid -= blksz) { resid -= blksz) {
inblk = crypto_cursor_segment(&cc_in, &len); inblk = crypto_cursor_segment(&cc_in, &len);
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else } else
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->decrypt(swe->sw_ctx, inblk, outblk); exf->decrypt(ctx, inblk, outblk);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
exf->decrypt_last(swe->sw_ctx, blk, blk, resid); exf->decrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
} else { } else {
/* Inject the authentication data */ /* Inject the authentication data */
crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag); crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag);
} }
out: out:
explicit_bzero(ctx, exf->ctxsize);
explicit_bzero(blkbuf, sizeof(blkbuf)); explicit_bzero(blkbuf, sizeof(blkbuf));
explicit_bzero(tag, sizeof(tag)); explicit_bzero(tag, sizeof(tag));
return (error); return (error);
} }
static int static int
swcr_chacha20_poly1305(struct swcr_session *ses, struct cryptop *crp) swcr_chacha20_poly1305(struct swcr_session *ses, struct cryptop *crp)
{ {
const struct crypto_session_params *csp; const struct crypto_session_params *csp;
uint64_t blkbuf[howmany(CHACHA20_NATIVE_BLOCK_LEN, sizeof(uint64_t))]; uint64_t blkbuf[howmany(CHACHA20_NATIVE_BLOCK_LEN, sizeof(uint64_t))];
u_char *blk = (u_char *)blkbuf; u_char *blk = (u_char *)blkbuf;
u_char tag[POLY1305_HASH_LEN]; u_char tag[POLY1305_HASH_LEN];
struct crypto_buffer_cursor cc_in, cc_out; struct crypto_buffer_cursor cc_in, cc_out;
const u_char *inblk; const u_char *inblk;
u_char *outblk; u_char *outblk;
uint64_t *blkp; uint64_t *blkp;
struct swcr_auth *swa; const struct swcr_auth *swa;
struct swcr_encdec *swe; const struct swcr_encdec *swe;
const struct enc_xform *exf; const struct enc_xform *exf;
void *ctx;
size_t len; size_t len;
int blksz, error, r, resid; int blksz, error, r, resid;
swa = &ses->swcr_auth; swa = &ses->swcr_auth;
swe = &ses->swcr_encdec; swe = &ses->swcr_encdec;
exf = swe->sw_exf; exf = swe->sw_exf;
blksz = exf->native_blocksize; blksz = exf->native_blocksize;
KASSERT(blksz <= sizeof(blkbuf), ("%s: blocksize mismatch", __func__)); KASSERT(blksz <= sizeof(blkbuf), ("%s: blocksize mismatch", __func__));
if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0) if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
return (EINVAL); return (EINVAL);
csp = crypto_get_params(crp->crp_session); csp = crypto_get_params(crp->crp_session);
ctx = __builtin_alloca(exf->ctxsize);
if (crp->crp_cipher_key != NULL) if (crp->crp_cipher_key != NULL)
exf->setkey(swe->sw_ctx, crp->crp_cipher_key, exf->setkey(ctx, crp->crp_cipher_key,
csp->csp_cipher_klen); csp->csp_cipher_klen);
exf->reinit(swe->sw_ctx, crp->crp_iv, csp->csp_ivlen); else
memcpy(ctx, swe->sw_ctx, exf->ctxsize);
exf->reinit(ctx, crp->crp_iv, csp->csp_ivlen);
/* Supply MAC with AAD */ /* Supply MAC with AAD */
if (crp->crp_aad != NULL) if (crp->crp_aad != NULL)
exf->update(swe->sw_ctx, crp->crp_aad, exf->update(ctx, crp->crp_aad, crp->crp_aad_length);
crp->crp_aad_length);
else else
crypto_apply(crp, crp->crp_aad_start, crypto_apply(crp, crp->crp_aad_start, crp->crp_aad_length,
crp->crp_aad_length, exf->update, swe->sw_ctx); exf->update, ctx);
if (crp->crp_aad_length % 16 != 0) { if (crp->crp_aad_length % 16 != 0) {
/* padding1 */ /* padding1 */
memset(blk, 0, 16); memset(blk, 0, 16);
exf->update(swe->sw_ctx, blk, exf->update(ctx, blk, 16 - crp->crp_aad_length % 16);
16 - crp->crp_aad_length % 16);
} }
/* Do encryption with MAC */ /* Do encryption with MAC */
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_payload_start); crypto_cursor_advance(&cc_in, crp->crp_payload_start);
if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) { if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
crypto_cursor_init(&cc_out, &crp->crp_obuf); crypto_cursor_init(&cc_out, &crp->crp_obuf);
crypto_cursor_advance(&cc_out, crp->crp_payload_output_start); crypto_cursor_advance(&cc_out, crp->crp_payload_output_start);
} else } else
cc_out = cc_in; cc_out = cc_in;
for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) { for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) {
inblk = crypto_cursor_segment(&cc_in, &len); inblk = crypto_cursor_segment(&cc_in, &len);
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else } else
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->encrypt(swe->sw_ctx, inblk, outblk); exf->encrypt(ctx, inblk, outblk);
exf->update(swe->sw_ctx, outblk, blksz); exf->update(ctx, outblk, blksz);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} else { } else {
exf->update(swe->sw_ctx, inblk, blksz); exf->update(ctx, inblk, blksz);
} }
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
exf->encrypt_last(swe->sw_ctx, blk, blk, resid); exf->encrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
exf->update(swe->sw_ctx, blk, resid); exf->update(ctx, blk, resid);
if (resid % 16 != 0) { if (resid % 16 != 0) {
/* padding2 */ /* padding2 */
memset(blk, 0, 16); memset(blk, 0, 16);
exf->update(swe->sw_ctx, blk, 16 - resid % 16); exf->update(ctx, blk, 16 - resid % 16);
} }
} }
/* lengths */ /* lengths */
blkp = (uint64_t *)blk; blkp = (uint64_t *)blk;
blkp[0] = htole64(crp->crp_aad_length); blkp[0] = htole64(crp->crp_aad_length);
blkp[1] = htole64(crp->crp_payload_length); blkp[1] = htole64(crp->crp_payload_length);
exf->update(swe->sw_ctx, blk, sizeof(uint64_t) * 2); exf->update(ctx, blk, sizeof(uint64_t) * 2);
/* Finalize MAC */ /* Finalize MAC */
exf->final(tag, swe->sw_ctx); exf->final(tag, ctx);
/* Validate tag */ /* Validate tag */
error = 0; error = 0;
if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
u_char tag2[POLY1305_HASH_LEN]; u_char tag2[POLY1305_HASH_LEN];
crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, tag2); crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, tag2);
Show All 13 Lines for (resid = crp->crp_payload_length; resid > blksz;
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else } else
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->decrypt(swe->sw_ctx, inblk, outblk); exf->decrypt(ctx, inblk, outblk);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
exf->decrypt_last(swe->sw_ctx, blk, blk, resid); exf->decrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
} else { } else {
/* Inject the authentication data */ /* Inject the authentication data */
crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag); crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag);
} }
out: out:
explicit_bzero(ctx, exf->ctxsize);
explicit_bzero(blkbuf, sizeof(blkbuf)); explicit_bzero(blkbuf, sizeof(blkbuf));
explicit_bzero(tag, sizeof(tag)); explicit_bzero(tag, sizeof(tag));
return (error); return (error);
} }
/* /*
* Apply a cipher and a digest to perform EtA. * Apply a cipher and a digest to perform EtA.
*/ */
▲ Show 20 Lines • Show All 105 Lines • ▼ Show 20 Linesswcr_setup_cipher(struct swcr_session *ses,
const struct crypto_session_params *csp) const struct crypto_session_params *csp)
{ {
struct swcr_encdec *swe; struct swcr_encdec *swe;
const struct enc_xform *txf; const struct enc_xform *txf;
int error; int error;
swe = &ses->swcr_encdec; swe = &ses->swcr_encdec;
txf = crypto_cipher(csp); txf = crypto_cipher(csp);
if (csp->csp_cipher_key != NULL) {
if (txf->ctxsize != 0) { if (txf->ctxsize != 0) {
swe->sw_ctx = malloc(txf->ctxsize, M_CRYPTO_DATA, swe->sw_ctx = malloc(txf->ctxsize, M_CRYPTO_DATA,
M_NOWAIT); M_NOWAIT);
if (swe->sw_ctx == NULL) if (swe->sw_ctx == NULL)
return (ENOMEM); return (ENOMEM);
} }
if (csp->csp_cipher_key != NULL) {
error = txf->setkey(swe->sw_ctx, error = txf->setkey(swe->sw_ctx,
csp->csp_cipher_key, csp->csp_cipher_klen); csp->csp_cipher_key, csp->csp_cipher_klen);
if (error) if (error)
return (error); return (error);
} }
swe->sw_exf = txf; swe->sw_exf = txf;
return (0); return (0);
} }
▲ Show 20 Lines • Show All 457 Lines • Show Last 20 Lines
View Options

head/sys/sys/sysent.h

Show First 20 Lines • Show All 101 Lines • ▼ Show 20 Lines
*/ */
static int static int
swcr_encdec(struct swcr_session *ses, struct cryptop *crp) swcr_encdec(struct swcr_session *ses, struct cryptop *crp)
{ {
unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN]; unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN];
unsigned char *ivp, *nivp, iv2[EALG_MAX_BLOCK_LEN]; unsigned char *ivp, *nivp, iv2[EALG_MAX_BLOCK_LEN];
const struct crypto_session_params *csp; const struct crypto_session_params *csp;
const struct enc_xform *exf; const struct enc_xform *exf;
struct swcr_encdec *sw; const struct swcr_encdec *sw;
void *ctx;
markjUnsubmitted
Done
Inline Actions

Make sw a pointer to const?

markj: Make `sw` a pointer to const?
jhbAuthorUnsubmitted
Done
Inline Actions

Oh, that's a good idea, yes.

jhb: Oh, that's a good idea, yes.
size_t inlen, outlen; size_t inlen, outlen;
int i, blks, resid; int i, blks, resid;
struct crypto_buffer_cursor cc_in, cc_out; struct crypto_buffer_cursor cc_in, cc_out;
const unsigned char *inblk; const unsigned char *inblk;
unsigned char *outblk; unsigned char *outblk;
int error; int error;
bool encrypting; bool encrypting;
Show All 11 Lines if (exf->native_blocksize == 0) {
blks = exf->blocksize; blks = exf->blocksize;
} else } else
blks = exf->native_blocksize; blks = exf->native_blocksize;
if (exf == &enc_xform_aes_icm && if (exf == &enc_xform_aes_icm &&
(crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0) (crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
return (EINVAL); return (EINVAL);
ctx = __builtin_alloca(exf->ctxsize);
if (crp->crp_cipher_key != NULL) { if (crp->crp_cipher_key != NULL) {
error = exf->setkey(sw->sw_ctx, error = exf->setkey(ctx, crp->crp_cipher_key,
crp->crp_cipher_key, csp->csp_cipher_klen); csp->csp_cipher_klen);
if (error) if (error)
return (error); return (error);
} } else
memcpy(ctx, sw->sw_ctx, exf->ctxsize);
crypto_read_iv(crp, iv); crypto_read_iv(crp, iv);
if (exf->reinit) { if (exf->reinit) {
/* /*
* xforms that provide a reinit method perform all IV * xforms that provide a reinit method perform all IV
* handling themselves. * handling themselves.
*/ */
exf->reinit(sw->sw_ctx, iv, csp->csp_ivlen); exf->reinit(ctx, iv, csp->csp_ivlen);
} }
ivp = iv; ivp = iv;
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_payload_start); crypto_cursor_advance(&cc_in, crp->crp_payload_start);
inblk = crypto_cursor_segment(&cc_in, &inlen); inblk = crypto_cursor_segment(&cc_in, &inlen);
if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) { if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
Show All 26 Lines if (outlen < blks)
outblk = blk; outblk = blk;
/* /*
* Ciphers without a 'reinit' hook are assumed to be * Ciphers without a 'reinit' hook are assumed to be
* used in CBC mode where the chaining is done here. * used in CBC mode where the chaining is done here.
*/ */
if (exf->reinit != NULL) { if (exf->reinit != NULL) {
if (encrypting) if (encrypting)
exf->encrypt(sw->sw_ctx, inblk, outblk); exf->encrypt(ctx, inblk, outblk);
else else
exf->decrypt(sw->sw_ctx, inblk, outblk); exf->decrypt(ctx, inblk, outblk);
} else if (encrypting) { } else if (encrypting) {
/* XOR with previous block */ /* XOR with previous block */
for (i = 0; i < blks; i++) for (i = 0; i < blks; i++)
outblk[i] = inblk[i] ^ ivp[i]; outblk[i] = inblk[i] ^ ivp[i];
exf->encrypt(sw->sw_ctx, outblk, outblk); exf->encrypt(ctx, outblk, outblk);
/* /*
* Keep encrypted block for XOR'ing * Keep encrypted block for XOR'ing
* with next block * with next block
*/ */
memcpy(iv, outblk, blks); memcpy(iv, outblk, blks);
ivp = iv; ivp = iv;
} else { /* decrypt */ } else { /* decrypt */
/* /*
* Keep encrypted block for XOR'ing * Keep encrypted block for XOR'ing
* with next block * with next block
*/ */
nivp = (ivp == iv) ? iv2 : iv; nivp = (ivp == iv) ? iv2 : iv;
memcpy(nivp, inblk, blks); memcpy(nivp, inblk, blks);
exf->decrypt(sw->sw_ctx, inblk, outblk); exf->decrypt(ctx, inblk, outblk);
/* XOR with previous block */ /* XOR with previous block */
for (i = 0; i < blks; i++) for (i = 0; i < blks; i++)
outblk[i] ^= ivp[i]; outblk[i] ^= ivp[i];
ivp = nivp; ivp = nivp;
} }
Show All 31 Lines if (resid > 0) {
outblk = crypto_cursor_segment(&cc_out, &outlen); outblk = crypto_cursor_segment(&cc_out, &outlen);
if (inlen < resid) { if (inlen < resid) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
inblk = blk; inblk = blk;
} }
if (outlen < resid) if (outlen < resid)
outblk = blk; outblk = blk;
if (encrypting) if (encrypting)
exf->encrypt_last(sw->sw_ctx, inblk, outblk, exf->encrypt_last(ctx, inblk, outblk,
resid); resid);
else else
exf->decrypt_last(sw->sw_ctx, inblk, outblk, exf->decrypt_last(ctx, inblk, outblk,
resid); resid);
if (outlen < resid) if (outlen < resid)
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
explicit_bzero(ctx, exf->ctxsize);
explicit_bzero(blk, sizeof(blk)); explicit_bzero(blk, sizeof(blk));
explicit_bzero(iv, sizeof(iv)); explicit_bzero(iv, sizeof(iv));
explicit_bzero(iv2, sizeof(iv2)); explicit_bzero(iv2, sizeof(iv2));
return (0); return (0);
} }
static void static void
swcr_authprepare(const struct auth_hash *axf, struct swcr_auth *sw, swcr_authprepare(const struct auth_hash *axf, struct swcr_auth *sw,
▲ Show 20 Lines • Show All 177 Lines • ▼ Show 20 Lines
swcr_gcm(struct swcr_session *ses, struct cryptop *crp) swcr_gcm(struct swcr_session *ses, struct cryptop *crp)
{ {
uint32_t blkbuf[howmany(AES_BLOCK_LEN, sizeof(uint32_t))]; uint32_t blkbuf[howmany(AES_BLOCK_LEN, sizeof(uint32_t))];
u_char *blk = (u_char *)blkbuf; u_char *blk = (u_char *)blkbuf;
u_char tag[GMAC_DIGEST_LEN]; u_char tag[GMAC_DIGEST_LEN];
struct crypto_buffer_cursor cc_in, cc_out; struct crypto_buffer_cursor cc_in, cc_out;
const u_char *inblk; const u_char *inblk;
u_char *outblk; u_char *outblk;
struct swcr_auth *swa; const struct swcr_auth *swa;
struct swcr_encdec *swe; const struct swcr_encdec *swe;
markjUnsubmitted
Done
Inline Actions

Can swe and swa be declared const now?

markj: Can `swe` and `swa` be declared const now?
const struct enc_xform *exf; const struct enc_xform *exf;
void *ctx;
uint32_t *blkp; uint32_t *blkp;
size_t len; size_t len;
int blksz, error, ivlen, r, resid; int blksz, error, ivlen, r, resid;
swa = &ses->swcr_auth; swa = &ses->swcr_auth;
swe = &ses->swcr_encdec; swe = &ses->swcr_encdec;
exf = swe->sw_exf; exf = swe->sw_exf;
blksz = GMAC_BLOCK_LEN; blksz = GMAC_BLOCK_LEN;
KASSERT(blksz == exf->native_blocksize, KASSERT(blksz == exf->native_blocksize,
("%s: blocksize mismatch", __func__)); ("%s: blocksize mismatch", __func__));
if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0) if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
return (EINVAL); return (EINVAL);
ivlen = AES_GCM_IV_LEN; ivlen = AES_GCM_IV_LEN;
/* Supply cipher with nonce. */ ctx = __builtin_alloca(exf->ctxsize);
if (crp->crp_cipher_key != NULL) if (crp->crp_cipher_key != NULL)
exf->setkey(swe->sw_ctx, crp->crp_cipher_key, exf->setkey(ctx, crp->crp_cipher_key,
crypto_get_params(crp->crp_session)->csp_cipher_klen); crypto_get_params(crp->crp_session)->csp_cipher_klen);
exf->reinit(swe->sw_ctx, crp->crp_iv, ivlen); else
memcpy(ctx, swe->sw_ctx, exf->ctxsize);
exf->reinit(ctx, crp->crp_iv, ivlen);
/* Supply MAC with AAD */ /* Supply MAC with AAD */
if (crp->crp_aad != NULL) { if (crp->crp_aad != NULL) {
len = rounddown(crp->crp_aad_length, blksz); len = rounddown(crp->crp_aad_length, blksz);
if (len != 0) if (len != 0)
exf->update(swe->sw_ctx, crp->crp_aad, len); exf->update(ctx, crp->crp_aad, len);
if (crp->crp_aad_length != len) { if (crp->crp_aad_length != len) {
memset(blk, 0, blksz); memset(blk, 0, blksz);
memcpy(blk, (char *)crp->crp_aad + len, memcpy(blk, (char *)crp->crp_aad + len,
crp->crp_aad_length - len); crp->crp_aad_length - len);
exf->update(swe->sw_ctx, blk, blksz); exf->update(ctx, blk, blksz);
} }
} else { } else {
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_aad_start); crypto_cursor_advance(&cc_in, crp->crp_aad_start);
for (resid = crp->crp_aad_length; resid >= blksz; for (resid = crp->crp_aad_length; resid >= blksz;
resid -= len) { resid -= len) {
inblk = crypto_cursor_segment(&cc_in, &len); inblk = crypto_cursor_segment(&cc_in, &len);
if (len >= blksz) { if (len >= blksz) {
len = rounddown(MIN(len, resid), blksz); len = rounddown(MIN(len, resid), blksz);
crypto_cursor_advance(&cc_in, len); crypto_cursor_advance(&cc_in, len);
} else { } else {
len = blksz; len = blksz;
crypto_cursor_copydata(&cc_in, len, blk); crypto_cursor_copydata(&cc_in, len, blk);
inblk = blk; inblk = blk;
} }
exf->update(swe->sw_ctx, inblk, len); exf->update(ctx, inblk, len);
} }
if (resid > 0) { if (resid > 0) {
memset(blk, 0, blksz); memset(blk, 0, blksz);
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
exf->update(swe->sw_ctx, blk, blksz); exf->update(ctx, blk, blksz);
} }
} }
/* Do encryption with MAC */ /* Do encryption with MAC */
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_payload_start); crypto_cursor_advance(&cc_in, crp->crp_payload_start);
if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) { if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
crypto_cursor_init(&cc_out, &crp->crp_obuf); crypto_cursor_init(&cc_out, &crp->crp_obuf);
crypto_cursor_advance(&cc_out, crp->crp_payload_output_start); crypto_cursor_advance(&cc_out, crp->crp_payload_output_start);
} else } else
cc_out = cc_in; cc_out = cc_in;
for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) { for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) {
inblk = crypto_cursor_segment(&cc_in, &len); inblk = crypto_cursor_segment(&cc_in, &len);
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else { } else {
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
} }
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->encrypt(swe->sw_ctx, inblk, outblk); exf->encrypt(ctx, inblk, outblk);
exf->update(swe->sw_ctx, outblk, blksz); exf->update(ctx, outblk, blksz);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} else { } else {
exf->update(swe->sw_ctx, inblk, blksz); exf->update(ctx, inblk, blksz);
} }
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
exf->encrypt_last(swe->sw_ctx, blk, blk, resid); exf->encrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
exf->update(swe->sw_ctx, blk, resid); exf->update(ctx, blk, resid);
} }
/* length block */ /* length block */
memset(blk, 0, blksz); memset(blk, 0, blksz);
blkp = (uint32_t *)blk + 1; blkp = (uint32_t *)blk + 1;
*blkp = htobe32(crp->crp_aad_length * 8); *blkp = htobe32(crp->crp_aad_length * 8);
blkp = (uint32_t *)blk + 3; blkp = (uint32_t *)blk + 3;
*blkp = htobe32(crp->crp_payload_length * 8); *blkp = htobe32(crp->crp_payload_length * 8);
exf->update(swe->sw_ctx, blk, blksz); exf->update(ctx, blk, blksz);
/* Finalize MAC */ /* Finalize MAC */
exf->final(tag, swe->sw_ctx); exf->final(tag, ctx);
/* Validate tag */ /* Validate tag */
error = 0; error = 0;
if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
u_char tag2[GMAC_DIGEST_LEN]; u_char tag2[GMAC_DIGEST_LEN];
crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, tag2); crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, tag2);
Show All 13 Lines for (resid = crp->crp_payload_length; resid > blksz;
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else } else
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->decrypt(swe->sw_ctx, inblk, outblk); exf->decrypt(ctx, inblk, outblk);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
exf->decrypt_last(swe->sw_ctx, blk, blk, resid); exf->decrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
} else { } else {
/* Inject the authentication data */ /* Inject the authentication data */
crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag); crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag);
} }
out: out:
explicit_bzero(ctx, exf->ctxsize);
explicit_bzero(blkbuf, sizeof(blkbuf)); explicit_bzero(blkbuf, sizeof(blkbuf));
explicit_bzero(tag, sizeof(tag)); explicit_bzero(tag, sizeof(tag));
return (error); return (error);
} }
static void static void
build_ccm_b0(const char *nonce, u_int nonce_length, u_int aad_length, build_ccm_b0(const char *nonce, u_int nonce_length, u_int aad_length,
▲ Show 20 Lines • Show All 110 Lines • ▼ Show 20 Lines
{ {
const struct crypto_session_params *csp; const struct crypto_session_params *csp;
uint32_t blkbuf[howmany(AES_BLOCK_LEN, sizeof(uint32_t))]; uint32_t blkbuf[howmany(AES_BLOCK_LEN, sizeof(uint32_t))];
u_char *blk = (u_char *)blkbuf; u_char *blk = (u_char *)blkbuf;
u_char tag[AES_CBC_MAC_HASH_LEN]; u_char tag[AES_CBC_MAC_HASH_LEN];
struct crypto_buffer_cursor cc_in, cc_out; struct crypto_buffer_cursor cc_in, cc_out;
const u_char *inblk; const u_char *inblk;
u_char *outblk; u_char *outblk;
struct swcr_auth *swa; const struct swcr_auth *swa;
struct swcr_encdec *swe; const struct swcr_encdec *swe;
const struct enc_xform *exf; const struct enc_xform *exf;
void *ctx;
size_t len; size_t len;
int blksz, error, ivlen, r, resid; int blksz, error, ivlen, r, resid;
csp = crypto_get_params(crp->crp_session); csp = crypto_get_params(crp->crp_session);
swa = &ses->swcr_auth; swa = &ses->swcr_auth;
swe = &ses->swcr_encdec; swe = &ses->swcr_encdec;
exf = swe->sw_exf; exf = swe->sw_exf;
blksz = AES_BLOCK_LEN; blksz = AES_BLOCK_LEN;
KASSERT(blksz == exf->native_blocksize, KASSERT(blksz == exf->native_blocksize,
("%s: blocksize mismatch", __func__)); ("%s: blocksize mismatch", __func__));
if (crp->crp_payload_length > ccm_max_payload_length(csp)) if (crp->crp_payload_length > ccm_max_payload_length(csp))
return (EMSGSIZE); return (EMSGSIZE);
if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0) if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
return (EINVAL); return (EINVAL);
ivlen = csp->csp_ivlen; ivlen = csp->csp_ivlen;
ctx = __builtin_alloca(exf->ctxsize);
if (crp->crp_cipher_key != NULL) if (crp->crp_cipher_key != NULL)
exf->setkey(swe->sw_ctx, crp->crp_cipher_key, exf->setkey(ctx, crp->crp_cipher_key,
crypto_get_params(crp->crp_session)->csp_cipher_klen); crypto_get_params(crp->crp_session)->csp_cipher_klen);
exf->reinit(swe->sw_ctx, crp->crp_iv, ivlen); else
memcpy(ctx, swe->sw_ctx, exf->ctxsize);
exf->reinit(ctx, crp->crp_iv, ivlen);
/* Supply MAC with b0. */ /* Supply MAC with b0. */
_Static_assert(sizeof(blkbuf) >= CCM_CBC_BLOCK_LEN, _Static_assert(sizeof(blkbuf) >= CCM_CBC_BLOCK_LEN,
"blkbuf too small for b0"); "blkbuf too small for b0");
build_ccm_b0(crp->crp_iv, ivlen, crp->crp_aad_length, build_ccm_b0(crp->crp_iv, ivlen, crp->crp_aad_length,
crp->crp_payload_length, swa->sw_mlen, blk); crp->crp_payload_length, swa->sw_mlen, blk);
exf->update(swe->sw_ctx, blk, CCM_CBC_BLOCK_LEN); exf->update(ctx, blk, CCM_CBC_BLOCK_LEN);
/* Supply MAC with AAD */ /* Supply MAC with AAD */
if (crp->crp_aad_length != 0) { if (crp->crp_aad_length != 0) {
len = build_ccm_aad_length(crp->crp_aad_length, blk); len = build_ccm_aad_length(crp->crp_aad_length, blk);
exf->update(swe->sw_ctx, blk, len); exf->update(ctx, blk, len);
if (crp->crp_aad != NULL) if (crp->crp_aad != NULL)
exf->update(swe->sw_ctx, crp->crp_aad, exf->update(ctx, crp->crp_aad, crp->crp_aad_length);
crp->crp_aad_length);
else else
crypto_apply(crp, crp->crp_aad_start, crypto_apply(crp, crp->crp_aad_start,
crp->crp_aad_length, exf->update, crp->crp_aad_length, exf->update, ctx);
swe->sw_ctx);
/* Pad the AAD (including length field) to a full block. */ /* Pad the AAD (including length field) to a full block. */
len = (len + crp->crp_aad_length) % CCM_CBC_BLOCK_LEN; len = (len + crp->crp_aad_length) % CCM_CBC_BLOCK_LEN;
if (len != 0) { if (len != 0) {
len = CCM_CBC_BLOCK_LEN - len; len = CCM_CBC_BLOCK_LEN - len;
memset(blk, 0, CCM_CBC_BLOCK_LEN); memset(blk, 0, CCM_CBC_BLOCK_LEN);
exf->update(swe->sw_ctx, blk, len); exf->update(ctx, blk, len);
} }
} }
/* Do encryption/decryption with MAC */ /* Do encryption/decryption with MAC */
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_payload_start); crypto_cursor_advance(&cc_in, crp->crp_payload_start);
if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) { if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
crypto_cursor_init(&cc_out, &crp->crp_obuf); crypto_cursor_init(&cc_out, &crp->crp_obuf);
crypto_cursor_advance(&cc_out, crp->crp_payload_output_start); crypto_cursor_advance(&cc_out, crp->crp_payload_output_start);
} else } else
cc_out = cc_in; cc_out = cc_in;
for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) { for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) {
inblk = crypto_cursor_segment(&cc_in, &len); inblk = crypto_cursor_segment(&cc_in, &len);
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else } else
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->update(swe->sw_ctx, inblk, blksz); exf->update(ctx, inblk, blksz);
exf->encrypt(swe->sw_ctx, inblk, outblk); exf->encrypt(ctx, inblk, outblk);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} else { } else {
/* /*
* One of the problems with CCM+CBC is that * One of the problems with CCM+CBC is that
* the authentication is done on the * the authentication is done on the
* unencrypted data. As a result, we have to * unencrypted data. As a result, we have to
* decrypt the data twice: once to generate * decrypt the data twice: once to generate
* the tag and a second time after the tag is * the tag and a second time after the tag is
* verified. * verified.
*/ */
exf->decrypt(swe->sw_ctx, inblk, blk); exf->decrypt(ctx, inblk, blk);
exf->update(swe->sw_ctx, blk, blksz); exf->update(ctx, blk, blksz);
} }
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
exf->update(swe->sw_ctx, blk, resid); exf->update(ctx, blk, resid);
exf->encrypt_last(swe->sw_ctx, blk, blk, resid); exf->encrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} else { } else {
exf->decrypt_last(swe->sw_ctx, blk, blk, resid); exf->decrypt_last(ctx, blk, blk, resid);
exf->update(swe->sw_ctx, blk, resid); exf->update(ctx, blk, resid);
} }
} }
/* Finalize MAC */ /* Finalize MAC */
exf->final(tag, swe->sw_ctx); exf->final(tag, ctx);
/* Validate tag */ /* Validate tag */
error = 0; error = 0;
if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
u_char tag2[AES_CBC_MAC_HASH_LEN]; u_char tag2[AES_CBC_MAC_HASH_LEN];
crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen,
tag2); tag2);
r = timingsafe_bcmp(tag, tag2, swa->sw_mlen); r = timingsafe_bcmp(tag, tag2, swa->sw_mlen);
explicit_bzero(tag2, sizeof(tag2)); explicit_bzero(tag2, sizeof(tag2));
if (r != 0) { if (r != 0) {
error = EBADMSG; error = EBADMSG;
goto out; goto out;
} }
/* tag matches, decrypt data */ /* tag matches, decrypt data */
exf->reinit(swe->sw_ctx, crp->crp_iv, ivlen); exf->reinit(ctx, crp->crp_iv, ivlen);
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_payload_start); crypto_cursor_advance(&cc_in, crp->crp_payload_start);
for (resid = crp->crp_payload_length; resid > blksz; for (resid = crp->crp_payload_length; resid > blksz;
resid -= blksz) { resid -= blksz) {
inblk = crypto_cursor_segment(&cc_in, &len); inblk = crypto_cursor_segment(&cc_in, &len);
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else } else
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->decrypt(swe->sw_ctx, inblk, outblk); exf->decrypt(ctx, inblk, outblk);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
exf->decrypt_last(swe->sw_ctx, blk, blk, resid); exf->decrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
} else { } else {
/* Inject the authentication data */ /* Inject the authentication data */
crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag); crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag);
} }
out: out:
explicit_bzero(ctx, exf->ctxsize);
explicit_bzero(blkbuf, sizeof(blkbuf)); explicit_bzero(blkbuf, sizeof(blkbuf));
explicit_bzero(tag, sizeof(tag)); explicit_bzero(tag, sizeof(tag));
return (error); return (error);
} }
static int static int
swcr_chacha20_poly1305(struct swcr_session *ses, struct cryptop *crp) swcr_chacha20_poly1305(struct swcr_session *ses, struct cryptop *crp)
{ {
const struct crypto_session_params *csp; const struct crypto_session_params *csp;
uint64_t blkbuf[howmany(CHACHA20_NATIVE_BLOCK_LEN, sizeof(uint64_t))]; uint64_t blkbuf[howmany(CHACHA20_NATIVE_BLOCK_LEN, sizeof(uint64_t))];
u_char *blk = (u_char *)blkbuf; u_char *blk = (u_char *)blkbuf;
u_char tag[POLY1305_HASH_LEN]; u_char tag[POLY1305_HASH_LEN];
struct crypto_buffer_cursor cc_in, cc_out; struct crypto_buffer_cursor cc_in, cc_out;
const u_char *inblk; const u_char *inblk;
u_char *outblk; u_char *outblk;
uint64_t *blkp; uint64_t *blkp;
struct swcr_auth *swa; const struct swcr_auth *swa;
struct swcr_encdec *swe; const struct swcr_encdec *swe;
const struct enc_xform *exf; const struct enc_xform *exf;
void *ctx;
size_t len; size_t len;
int blksz, error, r, resid; int blksz, error, r, resid;
swa = &ses->swcr_auth; swa = &ses->swcr_auth;
swe = &ses->swcr_encdec; swe = &ses->swcr_encdec;
exf = swe->sw_exf; exf = swe->sw_exf;
blksz = exf->native_blocksize; blksz = exf->native_blocksize;
KASSERT(blksz <= sizeof(blkbuf), ("%s: blocksize mismatch", __func__)); KASSERT(blksz <= sizeof(blkbuf), ("%s: blocksize mismatch", __func__));
if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0) if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
return (EINVAL); return (EINVAL);
csp = crypto_get_params(crp->crp_session); csp = crypto_get_params(crp->crp_session);
ctx = __builtin_alloca(exf->ctxsize);
if (crp->crp_cipher_key != NULL) if (crp->crp_cipher_key != NULL)
exf->setkey(swe->sw_ctx, crp->crp_cipher_key, exf->setkey(ctx, crp->crp_cipher_key,
csp->csp_cipher_klen); csp->csp_cipher_klen);
exf->reinit(swe->sw_ctx, crp->crp_iv, csp->csp_ivlen); else
memcpy(ctx, swe->sw_ctx, exf->ctxsize);
exf->reinit(ctx, crp->crp_iv, csp->csp_ivlen);
/* Supply MAC with AAD */ /* Supply MAC with AAD */
if (crp->crp_aad != NULL) if (crp->crp_aad != NULL)
exf->update(swe->sw_ctx, crp->crp_aad, exf->update(ctx, crp->crp_aad, crp->crp_aad_length);
crp->crp_aad_length);
else else
crypto_apply(crp, crp->crp_aad_start, crypto_apply(crp, crp->crp_aad_start, crp->crp_aad_length,
crp->crp_aad_length, exf->update, swe->sw_ctx); exf->update, ctx);
if (crp->crp_aad_length % 16 != 0) { if (crp->crp_aad_length % 16 != 0) {
/* padding1 */ /* padding1 */
memset(blk, 0, 16); memset(blk, 0, 16);
exf->update(swe->sw_ctx, blk, exf->update(ctx, blk, 16 - crp->crp_aad_length % 16);
16 - crp->crp_aad_length % 16);
} }
/* Do encryption with MAC */ /* Do encryption with MAC */
crypto_cursor_init(&cc_in, &crp->crp_buf); crypto_cursor_init(&cc_in, &crp->crp_buf);
crypto_cursor_advance(&cc_in, crp->crp_payload_start); crypto_cursor_advance(&cc_in, crp->crp_payload_start);
if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) { if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
crypto_cursor_init(&cc_out, &crp->crp_obuf); crypto_cursor_init(&cc_out, &crp->crp_obuf);
crypto_cursor_advance(&cc_out, crp->crp_payload_output_start); crypto_cursor_advance(&cc_out, crp->crp_payload_output_start);
} else } else
cc_out = cc_in; cc_out = cc_in;
for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) { for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) {
inblk = crypto_cursor_segment(&cc_in, &len); inblk = crypto_cursor_segment(&cc_in, &len);
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else } else
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->encrypt(swe->sw_ctx, inblk, outblk); exf->encrypt(ctx, inblk, outblk);
exf->update(swe->sw_ctx, outblk, blksz); exf->update(ctx, outblk, blksz);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} else { } else {
exf->update(swe->sw_ctx, inblk, blksz); exf->update(ctx, inblk, blksz);
} }
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
exf->encrypt_last(swe->sw_ctx, blk, blk, resid); exf->encrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
exf->update(swe->sw_ctx, blk, resid); exf->update(ctx, blk, resid);
if (resid % 16 != 0) { if (resid % 16 != 0) {
/* padding2 */ /* padding2 */
memset(blk, 0, 16); memset(blk, 0, 16);
exf->update(swe->sw_ctx, blk, 16 - resid % 16); exf->update(ctx, blk, 16 - resid % 16);
} }
} }
/* lengths */ /* lengths */
blkp = (uint64_t *)blk; blkp = (uint64_t *)blk;
blkp[0] = htole64(crp->crp_aad_length); blkp[0] = htole64(crp->crp_aad_length);
blkp[1] = htole64(crp->crp_payload_length); blkp[1] = htole64(crp->crp_payload_length);
exf->update(swe->sw_ctx, blk, sizeof(uint64_t) * 2); exf->update(ctx, blk, sizeof(uint64_t) * 2);
/* Finalize MAC */ /* Finalize MAC */
exf->final(tag, swe->sw_ctx); exf->final(tag, ctx);
/* Validate tag */ /* Validate tag */
error = 0; error = 0;
if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) { if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
u_char tag2[POLY1305_HASH_LEN]; u_char tag2[POLY1305_HASH_LEN];
crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, tag2); crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, tag2);
Show All 13 Lines for (resid = crp->crp_payload_length; resid > blksz;
if (len < blksz) { if (len < blksz) {
crypto_cursor_copydata(&cc_in, blksz, blk); crypto_cursor_copydata(&cc_in, blksz, blk);
inblk = blk; inblk = blk;
} else } else
crypto_cursor_advance(&cc_in, blksz); crypto_cursor_advance(&cc_in, blksz);
outblk = crypto_cursor_segment(&cc_out, &len); outblk = crypto_cursor_segment(&cc_out, &len);
if (len < blksz) if (len < blksz)
outblk = blk; outblk = blk;
exf->decrypt(swe->sw_ctx, inblk, outblk); exf->decrypt(ctx, inblk, outblk);
if (outblk == blk) if (outblk == blk)
crypto_cursor_copyback(&cc_out, blksz, blk); crypto_cursor_copyback(&cc_out, blksz, blk);
else else
crypto_cursor_advance(&cc_out, blksz); crypto_cursor_advance(&cc_out, blksz);
} }
if (resid > 0) { if (resid > 0) {
crypto_cursor_copydata(&cc_in, resid, blk); crypto_cursor_copydata(&cc_in, resid, blk);
exf->decrypt_last(swe->sw_ctx, blk, blk, resid); exf->decrypt_last(ctx, blk, blk, resid);
crypto_cursor_copyback(&cc_out, resid, blk); crypto_cursor_copyback(&cc_out, resid, blk);
} }
} else { } else {
/* Inject the authentication data */ /* Inject the authentication data */
crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag); crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag);
} }
out: out:
explicit_bzero(ctx, exf->ctxsize);
explicit_bzero(blkbuf, sizeof(blkbuf)); explicit_bzero(blkbuf, sizeof(blkbuf));
explicit_bzero(tag, sizeof(tag)); explicit_bzero(tag, sizeof(tag));
return (error); return (error);
} }
/* /*
* Apply a cipher and a digest to perform EtA. * Apply a cipher and a digest to perform EtA.
*/ */
▲ Show 20 Lines • Show All 105 Lines • ▼ Show 20 Linesswcr_setup_cipher(struct swcr_session *ses,
const struct crypto_session_params *csp) const struct crypto_session_params *csp)
{ {
struct swcr_encdec *swe; struct swcr_encdec *swe;
const struct enc_xform *txf; const struct enc_xform *txf;
int error; int error;
swe = &ses->swcr_encdec; swe = &ses->swcr_encdec;
txf = crypto_cipher(csp); txf = crypto_cipher(csp);
if (csp->csp_cipher_key != NULL) {
if (txf->ctxsize != 0) { if (txf->ctxsize != 0) {
swe->sw_ctx = malloc(txf->ctxsize, M_CRYPTO_DATA, swe->sw_ctx = malloc(txf->ctxsize, M_CRYPTO_DATA,
M_NOWAIT); M_NOWAIT);
if (swe->sw_ctx == NULL) if (swe->sw_ctx == NULL)
return (ENOMEM); return (ENOMEM);
} }
if (csp->csp_cipher_key != NULL) {
error = txf->setkey(swe->sw_ctx, error = txf->setkey(swe->sw_ctx,
csp->csp_cipher_key, csp->csp_cipher_klen); csp->csp_cipher_key, csp->csp_cipher_klen);
if (error) if (error)
return (error); return (error);
} }
swe->sw_exf = txf; swe->sw_exf = txf;
return (0); return (0);
} }
▲ Show 20 Lines • Show All 457 Lines • Show Last 20 Lines