Page MenuHomeFreeBSD
Differential D26561

Explicit CTLFLAG_DYN not needed
ClosedPublic
Actions

Authored by freqlabs on Sep 25 2020, 6:43 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Mar 7, 4:06 PM
Unknown Object (File)
Feb 2 2025, 10:33 PM
Unknown Object (File)
Jan 27 2025, 3:43 PM
Unknown Object (File)
Jan 24 2025, 5:54 AM
Unknown Object (File)
Jan 24 2025, 5:46 AM
Unknown Object (File)
Jan 24 2025, 1:32 AM
Unknown Object (File)
Jan 18 2025, 5:17 PM
Unknown Object (File)
Dec 13 2024, 5:53 PM
View All 93 Files
Subscribers
imp

Details

Reviewers
jhb
cy
Commits
rS366651: MFC r366433
rS366433: Explicit CTLFLAG_DYN not needed
Summary

"Dynamically created OIDs automatically get this flag set."

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Revision Contents
Changeset List

PathSize
head/
sys/
contrib/
ipfilter/
netinet/
8 lines
x86/
bios/
10 lines

Diff 77864

View Options

head/sys/contrib/ipfilter/netinet/mlfk_ipl.c

Show First 20 Lines • Show All 531 Lines • ▼ Show 20 Lines if (ioctl(ses.fd, CIOCCRYPT, &cop) < 0) {
return (false); return (false);
} }
*cridp = ses.crid; *cridp = ses.crid;
ocf_destroy_session(&ses); ocf_destroy_session(&ses);
return (true); return (true);
} }
static void static bool
openssl_hash(const struct alg *alg, const EVP_MD *md, const void *buffer, openssl_hash(const struct alg *alg, const EVP_MD *md, const void *buffer,
size_t size, void *digest_out, unsigned *digest_sz_out) size_t size, void *digest_out, unsigned *digest_sz_out)
{ {
EVP_MD_CTX *mdctx; EVP_MD_CTX *mdctx;
const char *errs; const char *errs;
int rc; int rc;
errs = ""; errs = "";
Show All 10 Linesopenssl_hash(const struct alg *alg, const EVP_MD *md, const void *buffer,
if (rc != 1) if (rc != 1)
goto err_out; goto err_out;
rc = EVP_DigestFinal_ex(mdctx, digest_out, digest_sz_out); rc = EVP_DigestFinal_ex(mdctx, digest_out, digest_sz_out);
if (rc != 1) if (rc != 1)
goto err_out; goto err_out;
EVP_MD_CTX_destroy(mdctx); EVP_MD_CTX_destroy(mdctx);
return; return (true);
err_out: err_out:
errx(1, "OpenSSL %s HASH failed%s: %s", alg->name, errs, warnx("OpenSSL %s HASH failed%s: %s", alg->name, errs,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
return (false);
} }
static void static void
run_hash_test(const struct alg *alg, size_t size) run_hash_test(const struct alg *alg, size_t size)
{ {
const EVP_MD *md; const EVP_MD *md;
char *buffer; char *buffer;
u_int digest_len; u_int digest_len;
int crid; int crid;
char control_digest[EVP_MAX_MD_SIZE], test_digest[EVP_MAX_MD_SIZE]; char control_digest[EVP_MAX_MD_SIZE], test_digest[EVP_MAX_MD_SIZE];
memset(control_digest, 0x3c, sizeof(control_digest)); memset(control_digest, 0x3c, sizeof(control_digest));
memset(test_digest, 0x3c, sizeof(test_digest)); memset(test_digest, 0x3c, sizeof(test_digest));
md = alg->evp_md(); md = alg->evp_md();
assert((size_t)EVP_MD_size(md) <= sizeof(control_digest)); assert((size_t)EVP_MD_size(md) <= sizeof(control_digest));
buffer = alloc_buffer(size); buffer = alloc_buffer(size);
/* OpenSSL HASH. */ /* OpenSSL HASH. */
digest_len = sizeof(control_digest); digest_len = sizeof(control_digest);
openssl_hash(alg, md, buffer, size, control_digest, &digest_len); if (!openssl_hash(alg, md, buffer, size, control_digest, &digest_len))
goto out;
/* cryptodev HASH. */ /* cryptodev HASH. */
if (!ocf_hash(alg, buffer, size, test_digest, &crid)) if (!ocf_hash(alg, buffer, size, test_digest, &crid))
goto out; goto out;
if (memcmp(control_digest, test_digest, sizeof(control_digest)) != 0) { if (memcmp(control_digest, test_digest, sizeof(control_digest)) != 0) {
if (memcmp(control_digest, test_digest, EVP_MD_size(md)) == 0) if (memcmp(control_digest, test_digest, EVP_MD_size(md)) == 0)
printf("%s (%zu) mismatch in trailer:\n", printf("%s (%zu) mismatch in trailer:\n",
alg->name, size); alg->name, size);
▲ Show 20 Lines • Show All 64 Lines • ▼ Show 20 Linesrun_hmac_test(const struct alg *alg, size_t size)
assert((size_t)EVP_MD_size(md) <= sizeof(control_digest)); assert((size_t)EVP_MD_size(md) <= sizeof(control_digest));
key = alloc_buffer(key_len); key = alloc_buffer(key_len);
buffer = alloc_buffer(size); buffer = alloc_buffer(size);
/* OpenSSL HMAC. */ /* OpenSSL HMAC. */
digest_len = sizeof(control_digest); digest_len = sizeof(control_digest);
if (HMAC(md, key, key_len, (u_char *)buffer, size, if (HMAC(md, key, key_len, (u_char *)buffer, size,
(u_char *)control_digest, &digest_len) == NULL) (u_char *)control_digest, &digest_len) == NULL) {
errx(1, "OpenSSL %s (%zu) HMAC failed: %s", alg->name, warnx("OpenSSL %s (%zu) HMAC failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto out;
}
/* cryptodev HMAC. */ /* cryptodev HMAC. */
if (!ocf_hmac(alg, buffer, size, key, key_len, test_digest, &crid)) if (!ocf_hmac(alg, buffer, size, key, key_len, test_digest, &crid))
goto out; goto out;
if (memcmp(control_digest, test_digest, sizeof(control_digest)) != 0) { if (memcmp(control_digest, test_digest, sizeof(control_digest)) != 0) {
if (memcmp(control_digest, test_digest, EVP_MD_size(md)) == 0) if (memcmp(control_digest, test_digest, EVP_MD_size(md)) == 0)
printf("%s (%zu) mismatch in trailer:\n", printf("%s (%zu) mismatch in trailer:\n",
alg->name, size); alg->name, size);
Show All 10 Lines if (verbose)
printf("%s (%zu) matched (cryptodev device %s)\n", printf("%s (%zu) matched (cryptodev device %s)\n",
alg->name, size, crfind(crid)); alg->name, size, crfind(crid));
out: out:
free(buffer); free(buffer);
free(key); free(key);
} }
static void static bool
openssl_cipher(const struct alg *alg, const EVP_CIPHER *cipher, const char *key, openssl_cipher(const struct alg *alg, const EVP_CIPHER *cipher, const char *key,
const char *iv, const char *input, char *output, size_t size, int enc) const char *iv, const char *input, char *output, size_t size, int enc)
{ {
EVP_CIPHER_CTX *ctx; EVP_CIPHER_CTX *ctx;
int outl, total; int outl, total;
ctx = EVP_CIPHER_CTX_new(); ctx = EVP_CIPHER_CTX_new();
if (ctx == NULL) if (ctx == NULL) {
errx(1, "OpenSSL %s (%zu) ctx new failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx new failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
return (false);
}
if (EVP_CipherInit_ex(ctx, cipher, NULL, (const u_char *)key, if (EVP_CipherInit_ex(ctx, cipher, NULL, (const u_char *)key,
(const u_char *)iv, enc) != 1) (const u_char *)iv, enc) != 1) {
errx(1, "OpenSSL %s (%zu) ctx init failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx init failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_set_padding(ctx, 0); EVP_CIPHER_CTX_set_padding(ctx, 0);
if (EVP_CipherUpdate(ctx, (u_char *)output, &outl, if (EVP_CipherUpdate(ctx, (u_char *)output, &outl,
(const u_char *)input, size) != 1) (const u_char *)input, size) != 1) {
errx(1, "OpenSSL %s (%zu) cipher update failed: %s", alg->name, warnx("OpenSSL %s (%zu) cipher update failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total = outl; total = outl;
if (EVP_CipherFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) if (EVP_CipherFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
errx(1, "OpenSSL %s (%zu) cipher final failed: %s", alg->name, warnx("OpenSSL %s (%zu) cipher final failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total += outl; total += outl;
if ((size_t)total != size) if ((size_t)total != size) {
errx(1, "OpenSSL %s (%zu) cipher size mismatch: %d", alg->name, warnx("OpenSSL %s (%zu) cipher size mismatch: %d", alg->name,
size, total); size, total);
goto error;
}
EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_CTX_free(ctx);
return (true);
error:
EVP_CIPHER_CTX_free(ctx);
return (false);
} }
static bool static bool
ocf_init_cipher_session(const struct alg *alg, const char *key, size_t key_len, ocf_init_cipher_session(const struct alg *alg, const char *key, size_t key_len,
struct ocf_session *ses) struct ocf_session *ses)
{ {
struct session2_op sop; struct session2_op sop;
▲ Show 20 Lines • Show All 63 Lines • ▼ Show 20 Linesrun_cipher_test(const struct alg *alg, size_t size)
key = alloc_buffer(key_len); key = alloc_buffer(key_len);
iv = generate_iv(iv_len, alg); iv = generate_iv(iv_len, alg);
cleartext = alloc_buffer(size); cleartext = alloc_buffer(size);
buffer = malloc(size); buffer = malloc(size);
ciphertext = malloc(size); ciphertext = malloc(size);
/* OpenSSL cipher. */ /* OpenSSL cipher. */
openssl_cipher(alg, cipher, key, iv, cleartext, ciphertext, size, 1); if (!openssl_cipher(alg, cipher, key, iv, cleartext, ciphertext, size,
if (size > 0 && memcmp(cleartext, ciphertext, size) == 0) 1))
goto out_noocf;
if (size > 0 && memcmp(cleartext, ciphertext, size) == 0) {
warnx("OpenSSL %s (%zu): cipher text unchanged", alg->name, warnx("OpenSSL %s (%zu): cipher text unchanged", alg->name,
size); size);
openssl_cipher(alg, cipher, key, iv, ciphertext, buffer, size, 0); goto out_noocf;
}
if (!openssl_cipher(alg, cipher, key, iv, ciphertext, buffer, size, 0))
goto out_noocf;
if (memcmp(cleartext, buffer, size) != 0) { if (memcmp(cleartext, buffer, size) != 0) {
printf("OpenSSL %s (%zu): cipher mismatch:", alg->name, size); printf("OpenSSL %s (%zu): cipher mismatch:", alg->name, size);
printf("original:\n"); printf("original:\n");
hexdump(cleartext, size, NULL, 0); hexdump(cleartext, size, NULL, 0);
printf("decrypted:\n"); printf("decrypted:\n");
hexdump(buffer, size, NULL, 0); hexdump(buffer, size, NULL, 0);
exit(1); goto out_noocf;
} }
if (!ocf_init_cipher_session(alg, key, key_len, &ses)) if (!ocf_init_cipher_session(alg, key, key_len, &ses))
goto out; goto out_noocf;
/* OCF encrypt. */ /* OCF encrypt. */
if (!ocf_cipher(&ses, alg, iv, cleartext, buffer, size, COP_ENCRYPT)) if (!ocf_cipher(&ses, alg, iv, cleartext, buffer, size, COP_ENCRYPT))
goto out; goto out;
if (memcmp(ciphertext, buffer, size) != 0) { if (memcmp(ciphertext, buffer, size) != 0) {
printf("%s (%zu) encryption mismatch:\n", alg->name, size); printf("%s (%zu) encryption mismatch:\n", alg->name, size);
printf("control:\n"); printf("control:\n");
hexdump(ciphertext, size, NULL, 0); hexdump(ciphertext, size, NULL, 0);
Show All 15 Linesrun_cipher_test(const struct alg *alg, size_t size)
} }
if (verbose) if (verbose)
printf("%s (%zu) matched (cryptodev device %s)\n", printf("%s (%zu) matched (cryptodev device %s)\n",
alg->name, size, crfind(ses.crid)); alg->name, size, crfind(ses.crid));
out: out:
ocf_destroy_session(&ses); ocf_destroy_session(&ses);
out_noocf:
free(ciphertext); free(ciphertext);
free(buffer); free(buffer);
free(cleartext); free(cleartext);
free(iv); free(iv);
free(key); free(key);
} }
static bool static bool
▲ Show 20 Lines • Show All 99 Lines • ▼ Show 20 Linesrun_eta_test(const struct alg *alg, size_t aad_len, size_t size)
auth_key = alloc_buffer(auth_key_len); auth_key = alloc_buffer(auth_key_len);
cleartext = alloc_buffer(aad_len + size); cleartext = alloc_buffer(aad_len + size);
buffer = malloc(aad_len + size); buffer = malloc(aad_len + size);
ciphertext = malloc(aad_len + size); ciphertext = malloc(aad_len + size);
/* OpenSSL encrypt + HMAC. */ /* OpenSSL encrypt + HMAC. */
if (aad_len != 0) if (aad_len != 0)
memcpy(ciphertext, cleartext, aad_len); memcpy(ciphertext, cleartext, aad_len);
openssl_cipher(alg, cipher, cipher_key, iv, cleartext + aad_len, if (!openssl_cipher(alg, cipher, cipher_key, iv, cleartext + aad_len,
ciphertext + aad_len, size, 1); ciphertext + aad_len, size, 1))
goto out_noocf;
if (size > 0 && memcmp(cleartext + aad_len, ciphertext + aad_len, if (size > 0 && memcmp(cleartext + aad_len, ciphertext + aad_len,
size) == 0) size) == 0) {
warnx("OpenSSL %s (%zu, %zu): cipher text unchanged", warnx("OpenSSL %s (%zu, %zu): cipher text unchanged",
alg->name, aad_len, size); alg->name, aad_len, size);
goto out_noocf;
}
digest_len = sizeof(control_digest); digest_len = sizeof(control_digest);
if (HMAC(md, auth_key, auth_key_len, (u_char *)ciphertext, if (HMAC(md, auth_key, auth_key_len, (u_char *)ciphertext,
aad_len + size, (u_char *)control_digest, &digest_len) == NULL) aad_len + size, (u_char *)control_digest, &digest_len) == NULL) {
errx(1, "OpenSSL %s (%zu, %zu) HMAC failed: %s", alg->name, warnx("OpenSSL %s (%zu, %zu) HMAC failed: %s", alg->name,
aad_len, size, ERR_error_string(ERR_get_error(), NULL)); aad_len, size, ERR_error_string(ERR_get_error(), NULL));
goto out_noocf;
}
if (!ocf_init_eta_session(alg, cipher_key, cipher_key_len, auth_key, if (!ocf_init_eta_session(alg, cipher_key, cipher_key_len, auth_key,
auth_key_len, &ses)) auth_key_len, &ses))
goto out; goto out_noocf;
/* OCF encrypt + HMAC. */ /* OCF encrypt + HMAC. */
error = ocf_eta(&ses, iv, iv_len, aad_len != 0 ? cleartext : NULL, error = ocf_eta(&ses, iv, iv_len, aad_len != 0 ? cleartext : NULL,
aad_len, cleartext + aad_len, buffer + aad_len, size, test_digest, aad_len, cleartext + aad_len, buffer + aad_len, size, test_digest,
COP_ENCRYPT); COP_ENCRYPT);
if (error != 0) { if (error != 0) {
warnc(error, "cryptodev %s (%zu, %zu) ETA failed for device %s", warnc(error, "cryptodev %s (%zu, %zu) ETA failed for device %s",
alg->name, aad_len, size, crfind(ses.crid)); alg->name, aad_len, size, crfind(ses.crid));
▲ Show 20 Lines • Show All 59 Lines • ▼ Show 20 Linesrun_eta_test(const struct alg *alg, size_t aad_len, size_t size)
} }
if (verbose) if (verbose)
printf("%s (%zu, %zu) matched (cryptodev device %s)\n", printf("%s (%zu, %zu) matched (cryptodev device %s)\n",
alg->name, aad_len, size, crfind(ses.crid)); alg->name, aad_len, size, crfind(ses.crid));
out: out:
ocf_destroy_session(&ses); ocf_destroy_session(&ses);
out_noocf:
free(ciphertext); free(ciphertext);
free(buffer); free(buffer);
free(cleartext); free(cleartext);
free(auth_key); free(auth_key);
free(iv); free(iv);
free(cipher_key); free(cipher_key);
} }
static void static bool
openssl_gmac(const struct alg *alg, const EVP_CIPHER *cipher, const char *key, openssl_gmac(const struct alg *alg, const EVP_CIPHER *cipher, const char *key,
const char *iv, const char *input, size_t size, char *tag) const char *iv, const char *input, size_t size, char *tag)
{ {
EVP_CIPHER_CTX *ctx; EVP_CIPHER_CTX *ctx;
int outl; int outl;
ctx = EVP_CIPHER_CTX_new(); ctx = EVP_CIPHER_CTX_new();
if (ctx == NULL) if (ctx == NULL) {
errx(1, "OpenSSL %s (%zu) ctx new failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx new failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
return (false);
}
if (EVP_EncryptInit_ex(ctx, cipher, NULL, (const u_char *)key, if (EVP_EncryptInit_ex(ctx, cipher, NULL, (const u_char *)key,
(const u_char *)iv) != 1) (const u_char *)iv) != 1) {
errx(1, "OpenSSL %s (%zu) ctx init failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx init failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_set_padding(ctx, 0); EVP_CIPHER_CTX_set_padding(ctx, 0);
if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)input, if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)input,
size) != 1) size) != 1) {
errx(1, "OpenSSL %s (%zu) update failed: %s", warnx("OpenSSL %s (%zu) update failed: %s",
alg->name, size, ERR_error_string(ERR_get_error(), NULL)); alg->name, size, ERR_error_string(ERR_get_error(), NULL));
if (EVP_EncryptFinal_ex(ctx, NULL, &outl) != 1) goto error;
errx(1, "OpenSSL %s (%zu) final failed: %s", alg->name, }
if (EVP_EncryptFinal_ex(ctx, NULL, &outl) != 1) {
warnx("OpenSSL %s (%zu) final failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, alg->tag_len, if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, alg->tag_len,
tag) != 1) tag) != 1) {
errx(1, "OpenSSL %s (%zu) get tag failed: %s", alg->name, warnx("OpenSSL %s (%zu) get tag failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_CTX_free(ctx);
return (true);
error:
EVP_CIPHER_CTX_free(ctx);
return (false);
} }
static bool static bool
ocf_mac(const struct alg *alg, const char *input, size_t size, const char *key, ocf_mac(const struct alg *alg, const char *input, size_t size, const char *key,
size_t key_len, const char *iv, char *tag, int *cridp) size_t key_len, const char *iv, char *tag, int *cridp)
{ {
struct ocf_session ses; struct ocf_session ses;
struct session2_op sop; struct session2_op sop;
▲ Show 20 Lines • Show All 42 Lines • ▼ Show 20 Linesrun_gmac_test(const struct alg *alg, size_t size)
key_len = EVP_CIPHER_key_length(cipher); key_len = EVP_CIPHER_key_length(cipher);
iv_len = EVP_CIPHER_iv_length(cipher); iv_len = EVP_CIPHER_iv_length(cipher);
key = alloc_buffer(key_len); key = alloc_buffer(key_len);
iv = generate_iv(iv_len, alg); iv = generate_iv(iv_len, alg);
buffer = alloc_buffer(size); buffer = alloc_buffer(size);
/* OpenSSL GMAC. */ /* OpenSSL GMAC. */
openssl_gmac(alg, cipher, key, iv, buffer, size, control_tag); if (!openssl_gmac(alg, cipher, key, iv, buffer, size, control_tag))
goto out;
/* OCF GMAC. */ /* OCF GMAC. */
if (!ocf_mac(alg, buffer, size, key, key_len, iv, test_tag, &crid)) if (!ocf_mac(alg, buffer, size, key, key_len, iv, test_tag, &crid))
goto out; goto out;
if (memcmp(control_tag, test_tag, sizeof(control_tag)) != 0) { if (memcmp(control_tag, test_tag, sizeof(control_tag)) != 0) {
printf("%s (%zu) mismatch:\n", alg->name, size); printf("%s (%zu) mismatch:\n", alg->name, size);
printf("control:\n"); printf("control:\n");
hexdump(control_tag, sizeof(control_tag), NULL, 0); hexdump(control_tag, sizeof(control_tag), NULL, 0);
printf("test (cryptodev device %s):\n", crfind(crid)); printf("test (cryptodev device %s):\n", crfind(crid));
hexdump(test_tag, sizeof(test_tag), NULL, 0); hexdump(test_tag, sizeof(test_tag), NULL, 0);
goto out; goto out;
} }
if (verbose) if (verbose)
printf("%s (%zu) matched (cryptodev device %s)\n", printf("%s (%zu) matched (cryptodev device %s)\n",
alg->name, size, crfind(crid)); alg->name, size, crfind(crid));
out: out:
free(buffer); free(buffer);
free(iv); free(iv);
free(key); free(key);
} }
static void static bool
openssl_digest(const struct alg *alg, const char *key, u_int key_len, openssl_digest(const struct alg *alg, const char *key, u_int key_len,
const char *input, size_t size, char *tag, u_int tag_len) const char *input, size_t size, char *tag, u_int tag_len)
{ {
EVP_MD_CTX *mdctx; EVP_MD_CTX *mdctx;
EVP_PKEY *pkey; EVP_PKEY *pkey;
size_t len; size_t len;
pkey = EVP_PKEY_new_raw_private_key(alg->pkey, NULL, key, key_len); pkey = EVP_PKEY_new_raw_private_key(alg->pkey, NULL, key, key_len);
if (pkey == NULL) if (pkey == NULL) {
errx(1, "OpenSSL %s (%zu) pkey new failed: %s", alg->name, warnx("OpenSSL %s (%zu) pkey new failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
return (false);
}
mdctx = EVP_MD_CTX_new(); mdctx = EVP_MD_CTX_new();
if (mdctx == NULL) if (mdctx == NULL) {
errx(1, "OpenSSL %s (%zu) ctx new failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx new failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
if (EVP_DigestSignInit(mdctx, NULL, NULL, NULL, pkey) != 1) EVP_PKEY_free(pkey);
errx(1, "OpenSSL %s (%zu) digest sign init failed: %s", return (false);
}
if (EVP_DigestSignInit(mdctx, NULL, NULL, NULL, pkey) != 1) {
warnx("OpenSSL %s (%zu) digest sign init failed: %s",
alg->name, size, ERR_error_string(ERR_get_error(), NULL)); alg->name, size, ERR_error_string(ERR_get_error(), NULL));
if (EVP_DigestSignUpdate(mdctx, input, size) != 1) goto error;
errx(1, "OpenSSL %s (%zu) digest update failed: %s", alg->name, }
if (EVP_DigestSignUpdate(mdctx, input, size) != 1) {
warnx("OpenSSL %s (%zu) digest update failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
len = tag_len; len = tag_len;
if (EVP_DigestSignFinal(mdctx, tag, &len) != 1) if (EVP_DigestSignFinal(mdctx, tag, &len) != 1) {
errx(1, "OpenSSL %s (%zu) digest final failed: %s", alg->name, warnx("OpenSSL %s (%zu) digest final failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_MD_CTX_free(mdctx); EVP_MD_CTX_free(mdctx);
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
return (true);
error:
EVP_MD_CTX_free(mdctx);
EVP_PKEY_free(pkey);
return (false);
} }
static void static void
run_digest_test(const struct alg *alg, size_t size) run_digest_test(const struct alg *alg, size_t size)
{ {
char *key, *buffer; char *key, *buffer;
u_int key_len; u_int key_len;
int crid; int crid;
char control_tag[EVP_MAX_MD_SIZE], test_tag[EVP_MAX_MD_SIZE]; char control_tag[EVP_MAX_MD_SIZE], test_tag[EVP_MAX_MD_SIZE];
memset(control_tag, 0x3c, sizeof(control_tag)); memset(control_tag, 0x3c, sizeof(control_tag));
memset(test_tag, 0x3c, sizeof(test_tag)); memset(test_tag, 0x3c, sizeof(test_tag));
key_len = alg->key_len; key_len = alg->key_len;
key = alloc_buffer(key_len); key = alloc_buffer(key_len);
buffer = alloc_buffer(size); buffer = alloc_buffer(size);
/* OpenSSL Poly1305. */ /* OpenSSL Poly1305. */
openssl_digest(alg, key, key_len, buffer, size, control_tag, if (!openssl_digest(alg, key, key_len, buffer, size, control_tag,
sizeof(control_tag)); sizeof(control_tag)))
goto out;
/* OCF Poly1305. */ /* OCF Poly1305. */
if (!ocf_mac(alg, buffer, size, key, key_len, NULL, test_tag, &crid)) if (!ocf_mac(alg, buffer, size, key, key_len, NULL, test_tag, &crid))
goto out; goto out;
if (memcmp(control_tag, test_tag, sizeof(control_tag)) != 0) { if (memcmp(control_tag, test_tag, sizeof(control_tag)) != 0) {
printf("%s (%zu) mismatch:\n", alg->name, size); printf("%s (%zu) mismatch:\n", alg->name, size);
printf("control:\n"); printf("control:\n");
hexdump(control_tag, sizeof(control_tag), NULL, 0); hexdump(control_tag, sizeof(control_tag), NULL, 0);
printf("test (cryptodev device %s):\n", crfind(crid)); printf("test (cryptodev device %s):\n", crfind(crid));
hexdump(test_tag, sizeof(test_tag), NULL, 0); hexdump(test_tag, sizeof(test_tag), NULL, 0);
goto out; goto out;
} }
if (verbose) if (verbose)
printf("%s (%zu) matched (cryptodev device %s)\n", printf("%s (%zu) matched (cryptodev device %s)\n",
alg->name, size, crfind(crid)); alg->name, size, crfind(crid));
out: out:
free(buffer); free(buffer);
free(key); free(key);
} }
static void static bool
openssl_aead_encrypt(const struct alg *alg, const EVP_CIPHER *cipher, openssl_aead_encrypt(const struct alg *alg, const EVP_CIPHER *cipher,
const char *key, const char *iv, size_t iv_len, const char *aad, const char *key, const char *iv, size_t iv_len, const char *aad,
size_t aad_len, const char *input, char *output, size_t size, char *tag) size_t aad_len, const char *input, char *output, size_t size, char *tag)
{ {
EVP_CIPHER_CTX *ctx; EVP_CIPHER_CTX *ctx;
int outl, total; int outl, total;
ctx = EVP_CIPHER_CTX_new(); ctx = EVP_CIPHER_CTX_new();
if (ctx == NULL) if (ctx == NULL) {
errx(1, "OpenSSL %s (%zu) ctx new failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx new failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) return (false);
errx(1, "OpenSSL %s (%zu) ctx init failed: %s", alg->name, }
if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
warnx("OpenSSL %s (%zu) ctx init failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_len, NULL) != 1) goto error;
errx(1, "OpenSSL %s (%zu) setting iv length failed: %s", alg->name, }
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_len, NULL) !=
1) {
warnx("OpenSSL %s (%zu) setting iv length failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
if (EVP_EncryptInit_ex(ctx, NULL, NULL, (const u_char *)key, if (EVP_EncryptInit_ex(ctx, NULL, NULL, (const u_char *)key,
(const u_char *)iv) != 1) (const u_char *)iv) != 1) {
errx(1, "OpenSSL %s (%zu) ctx init failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx init failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_set_padding(ctx, 0); EVP_CIPHER_CTX_set_padding(ctx, 0);
if (aad != NULL) { if (aad != NULL) {
if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad, if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
aad_len) != 1) aad_len) != 1) {
errx(1, "OpenSSL %s (%zu) aad update failed: %s", warnx("OpenSSL %s (%zu) aad update failed: %s",
alg->name, size, alg->name, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
} }
}
if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl, if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl,
(const u_char *)input, size) != 1) (const u_char *)input, size) != 1) {
errx(1, "OpenSSL %s (%zu) encrypt update failed: %s", alg->name, warnx("OpenSSL %s (%zu) encrypt update failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total = outl; total = outl;
if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
errx(1, "OpenSSL %s (%zu) encrypt final failed: %s", alg->name, warnx("OpenSSL %s (%zu) encrypt final failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total += outl; total += outl;
if ((size_t)total != size) if ((size_t)total != size) {
errx(1, "OpenSSL %s (%zu) encrypt size mismatch: %d", alg->name, warnx("OpenSSL %s (%zu) encrypt size mismatch: %d", alg->name,
size, total); size, total);
goto error;
}
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, alg->tag_len, if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, alg->tag_len,
tag) != 1) tag) != 1) {
errx(1, "OpenSSL %s (%zu) get tag failed: %s", alg->name, warnx("OpenSSL %s (%zu) get tag failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_CTX_free(ctx);
return (true);
error:
EVP_CIPHER_CTX_free(ctx);
return (false);
} }
#ifdef notused #ifdef notused
static bool static bool
openssl_aead_decrypt(const struct alg *alg, const EVP_CIPHER *cipher, openssl_aead_decrypt(const struct alg *alg, const EVP_CIPHER *cipher,
const char *key, const char *iv, const char *aad, size_t aad_len, const char *key, const char *iv, const char *aad, size_t aad_len,
const char *input, char *output, size_t size, char *tag) const char *input, char *output, size_t size, char *tag)
{ {
Show All 31 Linesopenssl_aead_decrypt(const struct alg *alg, const EVP_CIPHER *cipher,
if (total != size) if (total != size)
errx(1, "OpenSSL %s (%zu) decrypt size mismatch: %d", alg->name, errx(1, "OpenSSL %s (%zu) decrypt size mismatch: %d", alg->name,
size, total); size, total);
EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_CTX_free(ctx);
return (valid); return (valid);
} }
#endif #endif
static void static bool
openssl_ccm_encrypt(const struct alg *alg, const EVP_CIPHER *cipher, openssl_ccm_encrypt(const struct alg *alg, const EVP_CIPHER *cipher,
const char *key, const char *iv, size_t iv_len, const char *aad, const char *key, const char *iv, size_t iv_len, const char *aad,
size_t aad_len, const char *input, char *output, size_t size, char *tag) size_t aad_len, const char *input, char *output, size_t size, char *tag)
{ {
EVP_CIPHER_CTX *ctx; EVP_CIPHER_CTX *ctx;
int outl, total; int outl, total;
ctx = EVP_CIPHER_CTX_new(); ctx = EVP_CIPHER_CTX_new();
if (ctx == NULL) if (ctx == NULL) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) ctx new failed: %s", warnx("OpenSSL %s/%zu (%zu, %zu) ctx new failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) return (false);
errx(1, "OpenSSL %s/%zu (%zu, %zu) ctx init failed: %s", }
if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
warnx("OpenSSL %s/%zu (%zu, %zu) ctx init failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_len, NULL) != 1) goto error;
errx(1, }
"OpenSSL %s/%zu (%zu, %zu) setting iv length failed: %s", if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_len, NULL) !=
1) {
warnx("OpenSSL %s/%zu (%zu, %zu) setting iv length failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, AES_CBC_MAC_HASH_LEN, NULL) != 1) goto error;
errx(1, }
"OpenSSL %s/%zu (%zu, %zu) setting tag length failed: %s", if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, AES_CBC_MAC_HASH_LEN,
NULL) != 1) {
warnx("OpenSSL %s/%zu (%zu, %zu) setting tag length failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
}
if (EVP_EncryptInit_ex(ctx, NULL, NULL, (const u_char *)key, if (EVP_EncryptInit_ex(ctx, NULL, NULL, (const u_char *)key,
(const u_char *)iv) != 1) (const u_char *)iv) != 1) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) ctx init failed: %s", warnx("OpenSSL %s/%zu (%zu, %zu) ctx init failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
if (EVP_EncryptUpdate(ctx, NULL, &outl, NULL, size) != 1) goto error;
errx(1, }
"OpenSSL %s/%zu (%zu, %zu) unable to set data length: %s", if (EVP_EncryptUpdate(ctx, NULL, &outl, NULL, size) != 1) {
warnx("OpenSSL %s/%zu (%zu, %zu) unable to set data length: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
}
if (aad != NULL) { if (aad != NULL) {
if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad, if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
aad_len) != 1) aad_len) != 1) {
errx(1, warnx("OpenSSL %s/%zu (%zu, %zu) aad update failed: %s",
"OpenSSL %s/%zu (%zu, %zu) aad update failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
} }
}
if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl, if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl,
(const u_char *)input, size) != 1) (const u_char *)input, size) != 1) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) encrypt update failed: %s", warnx("OpenSSL %s/%zu (%zu, %zu) encrypt update failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total = outl; total = outl;
if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) encrypt final failed: %s", warnx("OpenSSL %s/%zu (%zu, %zu) encrypt final failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total += outl; total += outl;
if ((size_t)total != size) if ((size_t)total != size) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) encrypt size mismatch: %d", warnx("OpenSSL %s/%zu (%zu, %zu) encrypt size mismatch: %d",
alg->name, iv_len, aad_len, size, total); alg->name, iv_len, aad_len, size, total);
goto error;
}
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, AES_CBC_MAC_HASH_LEN, if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, AES_CBC_MAC_HASH_LEN,
tag) != 1) tag) != 1) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) get tag failed: %s", warnx("OpenSSL %s/%zu (%zu, %zu) get tag failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_CTX_free(ctx);
return (true);
error:
EVP_CIPHER_CTX_free(ctx);
return (false);
} }
static bool static bool
ocf_init_aead_session(const struct alg *alg, const char *key, size_t key_len, ocf_init_aead_session(const struct alg *alg, const char *key, size_t key_len,
size_t iv_len, struct ocf_session *ses) size_t iv_len, struct ocf_session *ses)
{ {
struct session2_op sop; struct session2_op sop;
▲ Show 20 Lines • Show All 65 Lines • ▼ Show 20 Lines
{ {
struct ocf_session ses; struct ocf_session ses;
const EVP_CIPHER *cipher; const EVP_CIPHER *cipher;
char *aad, *buffer, *cleartext, *ciphertext; char *aad, *buffer, *cleartext, *ciphertext;
char *iv, *key; char *iv, *key;
u_int key_len; u_int key_len;
int error; int error;
char control_tag[AEAD_MAX_TAG_LEN], test_tag[AEAD_MAX_TAG_LEN]; char control_tag[AEAD_MAX_TAG_LEN], test_tag[AEAD_MAX_TAG_LEN];
bool ok;
cipher = alg->evp_cipher(); cipher = alg->evp_cipher();
if (size % EVP_CIPHER_block_size(cipher) != 0) { if (size % EVP_CIPHER_block_size(cipher) != 0) {
if (verbose) if (verbose)
printf( printf(
"%s/%zu (%zu, %zu): invalid buffer size (block size %d)\n", "%s/%zu (%zu, %zu): invalid buffer size (block size %d)\n",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
EVP_CIPHER_block_size(cipher)); EVP_CIPHER_block_size(cipher));
Show All 20 Linesrun_aead_test(const struct alg *alg, size_t aad_len, size_t size,
ciphertext = malloc(size); ciphertext = malloc(size);
if (aad_len != 0) if (aad_len != 0)
aad = alloc_buffer(aad_len); aad = alloc_buffer(aad_len);
else else
aad = NULL; aad = NULL;
/* OpenSSL encrypt */ /* OpenSSL encrypt */
if (EVP_CIPHER_mode(cipher) == EVP_CIPH_CCM_MODE) if (EVP_CIPHER_mode(cipher) == EVP_CIPH_CCM_MODE)
openssl_ccm_encrypt(alg, cipher, key, iv, iv_len, aad, ok = openssl_ccm_encrypt(alg, cipher, key, iv, iv_len, aad,
aad_len, cleartext, ciphertext, size, control_tag); aad_len, cleartext, ciphertext, size, control_tag);
else else
openssl_aead_encrypt(alg, cipher, key, iv, iv_len, aad, ok = openssl_aead_encrypt(alg, cipher, key, iv, iv_len, aad,
aad_len, cleartext, ciphertext, size, control_tag); aad_len, cleartext, ciphertext, size, control_tag);
if (!ok)
goto out_noocf;
if (!ocf_init_aead_session(alg, key, key_len, iv_len, &ses)) if (!ocf_init_aead_session(alg, key, key_len, iv_len, &ses))
goto out; goto out_noocf;
/* OCF encrypt */ /* OCF encrypt */
error = ocf_aead(&ses, iv, iv_len, aad, aad_len, cleartext, buffer, error = ocf_aead(&ses, iv, iv_len, aad, aad_len, cleartext, buffer,
size, test_tag, COP_ENCRYPT); size, test_tag, COP_ENCRYPT);
if (error != 0) { if (error != 0) {
warnc(error, "cryptodev %s/%zu (%zu, %zu) failed for device %s", warnc(error, "cryptodev %s/%zu (%zu, %zu) failed for device %s",
alg->name, iv_len, aad_len, size, crfind(ses.crid)); alg->name, iv_len, aad_len, size, crfind(ses.crid));
goto out; goto out;
▲ Show 20 Lines • Show All 52 Lines • ▼ Show 20 Linesrun_aead_test(const struct alg *alg, size_t aad_len, size_t size,
} }
if (verbose) if (verbose)
printf("%s/%zu (%zu, %zu) matched (cryptodev device %s)\n", printf("%s/%zu (%zu, %zu) matched (cryptodev device %s)\n",
alg->name, iv_len, aad_len, size, crfind(ses.crid)); alg->name, iv_len, aad_len, size, crfind(ses.crid));
out: out:
ocf_destroy_session(&ses); ocf_destroy_session(&ses);
out_noocf:
free(aad); free(aad);
free(ciphertext); free(ciphertext);
free(buffer); free(buffer);
free(cleartext); free(cleartext);
free(iv); free(iv);
free(key); free(key);
} }
▲ Show 20 Lines • Show All 295 Lines • Show Last 20 Lines
View Options

head/sys/x86/bios/vpd.c

Show First 20 Lines • Show All 531 Lines • ▼ Show 20 Lines if (ioctl(ses.fd, CIOCCRYPT, &cop) < 0) {
return (false); return (false);
} }
*cridp = ses.crid; *cridp = ses.crid;
ocf_destroy_session(&ses); ocf_destroy_session(&ses);
return (true); return (true);
} }
static void static bool
openssl_hash(const struct alg *alg, const EVP_MD *md, const void *buffer, openssl_hash(const struct alg *alg, const EVP_MD *md, const void *buffer,
size_t size, void *digest_out, unsigned *digest_sz_out) size_t size, void *digest_out, unsigned *digest_sz_out)
{ {
EVP_MD_CTX *mdctx; EVP_MD_CTX *mdctx;
const char *errs; const char *errs;
int rc; int rc;
errs = ""; errs = "";
Show All 10 Linesopenssl_hash(const struct alg *alg, const EVP_MD *md, const void *buffer,
if (rc != 1) if (rc != 1)
goto err_out; goto err_out;
rc = EVP_DigestFinal_ex(mdctx, digest_out, digest_sz_out); rc = EVP_DigestFinal_ex(mdctx, digest_out, digest_sz_out);
if (rc != 1) if (rc != 1)
goto err_out; goto err_out;
EVP_MD_CTX_destroy(mdctx); EVP_MD_CTX_destroy(mdctx);
return; return (true);
err_out: err_out:
errx(1, "OpenSSL %s HASH failed%s: %s", alg->name, errs, warnx("OpenSSL %s HASH failed%s: %s", alg->name, errs,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
return (false);
} }
static void static void
run_hash_test(const struct alg *alg, size_t size) run_hash_test(const struct alg *alg, size_t size)
{ {
const EVP_MD *md; const EVP_MD *md;
char *buffer; char *buffer;
u_int digest_len; u_int digest_len;
int crid; int crid;
char control_digest[EVP_MAX_MD_SIZE], test_digest[EVP_MAX_MD_SIZE]; char control_digest[EVP_MAX_MD_SIZE], test_digest[EVP_MAX_MD_SIZE];
memset(control_digest, 0x3c, sizeof(control_digest)); memset(control_digest, 0x3c, sizeof(control_digest));
memset(test_digest, 0x3c, sizeof(test_digest)); memset(test_digest, 0x3c, sizeof(test_digest));
md = alg->evp_md(); md = alg->evp_md();
assert((size_t)EVP_MD_size(md) <= sizeof(control_digest)); assert((size_t)EVP_MD_size(md) <= sizeof(control_digest));
buffer = alloc_buffer(size); buffer = alloc_buffer(size);
/* OpenSSL HASH. */ /* OpenSSL HASH. */
digest_len = sizeof(control_digest); digest_len = sizeof(control_digest);
openssl_hash(alg, md, buffer, size, control_digest, &digest_len); if (!openssl_hash(alg, md, buffer, size, control_digest, &digest_len))
goto out;
/* cryptodev HASH. */ /* cryptodev HASH. */
if (!ocf_hash(alg, buffer, size, test_digest, &crid)) if (!ocf_hash(alg, buffer, size, test_digest, &crid))
goto out; goto out;
if (memcmp(control_digest, test_digest, sizeof(control_digest)) != 0) { if (memcmp(control_digest, test_digest, sizeof(control_digest)) != 0) {
if (memcmp(control_digest, test_digest, EVP_MD_size(md)) == 0) if (memcmp(control_digest, test_digest, EVP_MD_size(md)) == 0)
printf("%s (%zu) mismatch in trailer:\n", printf("%s (%zu) mismatch in trailer:\n",
alg->name, size); alg->name, size);
▲ Show 20 Lines • Show All 64 Lines • ▼ Show 20 Linesrun_hmac_test(const struct alg *alg, size_t size)
assert((size_t)EVP_MD_size(md) <= sizeof(control_digest)); assert((size_t)EVP_MD_size(md) <= sizeof(control_digest));
key = alloc_buffer(key_len); key = alloc_buffer(key_len);
buffer = alloc_buffer(size); buffer = alloc_buffer(size);
/* OpenSSL HMAC. */ /* OpenSSL HMAC. */
digest_len = sizeof(control_digest); digest_len = sizeof(control_digest);
if (HMAC(md, key, key_len, (u_char *)buffer, size, if (HMAC(md, key, key_len, (u_char *)buffer, size,
(u_char *)control_digest, &digest_len) == NULL) (u_char *)control_digest, &digest_len) == NULL) {
errx(1, "OpenSSL %s (%zu) HMAC failed: %s", alg->name, warnx("OpenSSL %s (%zu) HMAC failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto out;
}
/* cryptodev HMAC. */ /* cryptodev HMAC. */
if (!ocf_hmac(alg, buffer, size, key, key_len, test_digest, &crid)) if (!ocf_hmac(alg, buffer, size, key, key_len, test_digest, &crid))
goto out; goto out;
if (memcmp(control_digest, test_digest, sizeof(control_digest)) != 0) { if (memcmp(control_digest, test_digest, sizeof(control_digest)) != 0) {
if (memcmp(control_digest, test_digest, EVP_MD_size(md)) == 0) if (memcmp(control_digest, test_digest, EVP_MD_size(md)) == 0)
printf("%s (%zu) mismatch in trailer:\n", printf("%s (%zu) mismatch in trailer:\n",
alg->name, size); alg->name, size);
Show All 10 Lines if (verbose)
printf("%s (%zu) matched (cryptodev device %s)\n", printf("%s (%zu) matched (cryptodev device %s)\n",
alg->name, size, crfind(crid)); alg->name, size, crfind(crid));
out: out:
free(buffer); free(buffer);
free(key); free(key);
} }
static void static bool
openssl_cipher(const struct alg *alg, const EVP_CIPHER *cipher, const char *key, openssl_cipher(const struct alg *alg, const EVP_CIPHER *cipher, const char *key,
const char *iv, const char *input, char *output, size_t size, int enc) const char *iv, const char *input, char *output, size_t size, int enc)
{ {
EVP_CIPHER_CTX *ctx; EVP_CIPHER_CTX *ctx;
int outl, total; int outl, total;
ctx = EVP_CIPHER_CTX_new(); ctx = EVP_CIPHER_CTX_new();
if (ctx == NULL) if (ctx == NULL) {
errx(1, "OpenSSL %s (%zu) ctx new failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx new failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
return (false);
}
if (EVP_CipherInit_ex(ctx, cipher, NULL, (const u_char *)key, if (EVP_CipherInit_ex(ctx, cipher, NULL, (const u_char *)key,
(const u_char *)iv, enc) != 1) (const u_char *)iv, enc) != 1) {
errx(1, "OpenSSL %s (%zu) ctx init failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx init failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_set_padding(ctx, 0); EVP_CIPHER_CTX_set_padding(ctx, 0);
if (EVP_CipherUpdate(ctx, (u_char *)output, &outl, if (EVP_CipherUpdate(ctx, (u_char *)output, &outl,
(const u_char *)input, size) != 1) (const u_char *)input, size) != 1) {
errx(1, "OpenSSL %s (%zu) cipher update failed: %s", alg->name, warnx("OpenSSL %s (%zu) cipher update failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total = outl; total = outl;
if (EVP_CipherFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) if (EVP_CipherFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
errx(1, "OpenSSL %s (%zu) cipher final failed: %s", alg->name, warnx("OpenSSL %s (%zu) cipher final failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total += outl; total += outl;
if ((size_t)total != size) if ((size_t)total != size) {
errx(1, "OpenSSL %s (%zu) cipher size mismatch: %d", alg->name, warnx("OpenSSL %s (%zu) cipher size mismatch: %d", alg->name,
size, total); size, total);
goto error;
}
EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_CTX_free(ctx);
return (true);
error:
EVP_CIPHER_CTX_free(ctx);
return (false);
} }
static bool static bool
ocf_init_cipher_session(const struct alg *alg, const char *key, size_t key_len, ocf_init_cipher_session(const struct alg *alg, const char *key, size_t key_len,
struct ocf_session *ses) struct ocf_session *ses)
{ {
struct session2_op sop; struct session2_op sop;
▲ Show 20 Lines • Show All 63 Lines • ▼ Show 20 Linesrun_cipher_test(const struct alg *alg, size_t size)
key = alloc_buffer(key_len); key = alloc_buffer(key_len);
iv = generate_iv(iv_len, alg); iv = generate_iv(iv_len, alg);
cleartext = alloc_buffer(size); cleartext = alloc_buffer(size);
buffer = malloc(size); buffer = malloc(size);
ciphertext = malloc(size); ciphertext = malloc(size);
/* OpenSSL cipher. */ /* OpenSSL cipher. */
openssl_cipher(alg, cipher, key, iv, cleartext, ciphertext, size, 1); if (!openssl_cipher(alg, cipher, key, iv, cleartext, ciphertext, size,
if (size > 0 && memcmp(cleartext, ciphertext, size) == 0) 1))
goto out_noocf;
if (size > 0 && memcmp(cleartext, ciphertext, size) == 0) {
warnx("OpenSSL %s (%zu): cipher text unchanged", alg->name, warnx("OpenSSL %s (%zu): cipher text unchanged", alg->name,
size); size);
openssl_cipher(alg, cipher, key, iv, ciphertext, buffer, size, 0); goto out_noocf;
}
if (!openssl_cipher(alg, cipher, key, iv, ciphertext, buffer, size, 0))
goto out_noocf;
if (memcmp(cleartext, buffer, size) != 0) { if (memcmp(cleartext, buffer, size) != 0) {
printf("OpenSSL %s (%zu): cipher mismatch:", alg->name, size); printf("OpenSSL %s (%zu): cipher mismatch:", alg->name, size);
printf("original:\n"); printf("original:\n");
hexdump(cleartext, size, NULL, 0); hexdump(cleartext, size, NULL, 0);
printf("decrypted:\n"); printf("decrypted:\n");
hexdump(buffer, size, NULL, 0); hexdump(buffer, size, NULL, 0);
exit(1); goto out_noocf;
} }
if (!ocf_init_cipher_session(alg, key, key_len, &ses)) if (!ocf_init_cipher_session(alg, key, key_len, &ses))
goto out; goto out_noocf;
/* OCF encrypt. */ /* OCF encrypt. */
if (!ocf_cipher(&ses, alg, iv, cleartext, buffer, size, COP_ENCRYPT)) if (!ocf_cipher(&ses, alg, iv, cleartext, buffer, size, COP_ENCRYPT))
goto out; goto out;
if (memcmp(ciphertext, buffer, size) != 0) { if (memcmp(ciphertext, buffer, size) != 0) {
printf("%s (%zu) encryption mismatch:\n", alg->name, size); printf("%s (%zu) encryption mismatch:\n", alg->name, size);
printf("control:\n"); printf("control:\n");
hexdump(ciphertext, size, NULL, 0); hexdump(ciphertext, size, NULL, 0);
Show All 15 Linesrun_cipher_test(const struct alg *alg, size_t size)
} }
if (verbose) if (verbose)
printf("%s (%zu) matched (cryptodev device %s)\n", printf("%s (%zu) matched (cryptodev device %s)\n",
alg->name, size, crfind(ses.crid)); alg->name, size, crfind(ses.crid));
out: out:
ocf_destroy_session(&ses); ocf_destroy_session(&ses);
out_noocf:
free(ciphertext); free(ciphertext);
free(buffer); free(buffer);
free(cleartext); free(cleartext);
free(iv); free(iv);
free(key); free(key);
} }
static bool static bool
▲ Show 20 Lines • Show All 99 Lines • ▼ Show 20 Linesrun_eta_test(const struct alg *alg, size_t aad_len, size_t size)
auth_key = alloc_buffer(auth_key_len); auth_key = alloc_buffer(auth_key_len);
cleartext = alloc_buffer(aad_len + size); cleartext = alloc_buffer(aad_len + size);
buffer = malloc(aad_len + size); buffer = malloc(aad_len + size);
ciphertext = malloc(aad_len + size); ciphertext = malloc(aad_len + size);
/* OpenSSL encrypt + HMAC. */ /* OpenSSL encrypt + HMAC. */
if (aad_len != 0) if (aad_len != 0)
memcpy(ciphertext, cleartext, aad_len); memcpy(ciphertext, cleartext, aad_len);
openssl_cipher(alg, cipher, cipher_key, iv, cleartext + aad_len, if (!openssl_cipher(alg, cipher, cipher_key, iv, cleartext + aad_len,
ciphertext + aad_len, size, 1); ciphertext + aad_len, size, 1))
goto out_noocf;
if (size > 0 && memcmp(cleartext + aad_len, ciphertext + aad_len, if (size > 0 && memcmp(cleartext + aad_len, ciphertext + aad_len,
size) == 0) size) == 0) {
warnx("OpenSSL %s (%zu, %zu): cipher text unchanged", warnx("OpenSSL %s (%zu, %zu): cipher text unchanged",
alg->name, aad_len, size); alg->name, aad_len, size);
goto out_noocf;
}
digest_len = sizeof(control_digest); digest_len = sizeof(control_digest);
if (HMAC(md, auth_key, auth_key_len, (u_char *)ciphertext, if (HMAC(md, auth_key, auth_key_len, (u_char *)ciphertext,
aad_len + size, (u_char *)control_digest, &digest_len) == NULL) aad_len + size, (u_char *)control_digest, &digest_len) == NULL) {
errx(1, "OpenSSL %s (%zu, %zu) HMAC failed: %s", alg->name, warnx("OpenSSL %s (%zu, %zu) HMAC failed: %s", alg->name,
aad_len, size, ERR_error_string(ERR_get_error(), NULL)); aad_len, size, ERR_error_string(ERR_get_error(), NULL));
goto out_noocf;
}
if (!ocf_init_eta_session(alg, cipher_key, cipher_key_len, auth_key, if (!ocf_init_eta_session(alg, cipher_key, cipher_key_len, auth_key,
auth_key_len, &ses)) auth_key_len, &ses))
goto out; goto out_noocf;
/* OCF encrypt + HMAC. */ /* OCF encrypt + HMAC. */
error = ocf_eta(&ses, iv, iv_len, aad_len != 0 ? cleartext : NULL, error = ocf_eta(&ses, iv, iv_len, aad_len != 0 ? cleartext : NULL,
aad_len, cleartext + aad_len, buffer + aad_len, size, test_digest, aad_len, cleartext + aad_len, buffer + aad_len, size, test_digest,
COP_ENCRYPT); COP_ENCRYPT);
if (error != 0) { if (error != 0) {
warnc(error, "cryptodev %s (%zu, %zu) ETA failed for device %s", warnc(error, "cryptodev %s (%zu, %zu) ETA failed for device %s",
alg->name, aad_len, size, crfind(ses.crid)); alg->name, aad_len, size, crfind(ses.crid));
▲ Show 20 Lines • Show All 59 Lines • ▼ Show 20 Linesrun_eta_test(const struct alg *alg, size_t aad_len, size_t size)
} }
if (verbose) if (verbose)
printf("%s (%zu, %zu) matched (cryptodev device %s)\n", printf("%s (%zu, %zu) matched (cryptodev device %s)\n",
alg->name, aad_len, size, crfind(ses.crid)); alg->name, aad_len, size, crfind(ses.crid));
out: out:
ocf_destroy_session(&ses); ocf_destroy_session(&ses);
out_noocf:
free(ciphertext); free(ciphertext);
free(buffer); free(buffer);
free(cleartext); free(cleartext);
free(auth_key); free(auth_key);
free(iv); free(iv);
free(cipher_key); free(cipher_key);
} }
static void static bool
openssl_gmac(const struct alg *alg, const EVP_CIPHER *cipher, const char *key, openssl_gmac(const struct alg *alg, const EVP_CIPHER *cipher, const char *key,
const char *iv, const char *input, size_t size, char *tag) const char *iv, const char *input, size_t size, char *tag)
{ {
EVP_CIPHER_CTX *ctx; EVP_CIPHER_CTX *ctx;
int outl; int outl;
ctx = EVP_CIPHER_CTX_new(); ctx = EVP_CIPHER_CTX_new();
if (ctx == NULL) if (ctx == NULL) {
errx(1, "OpenSSL %s (%zu) ctx new failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx new failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
return (false);
}
if (EVP_EncryptInit_ex(ctx, cipher, NULL, (const u_char *)key, if (EVP_EncryptInit_ex(ctx, cipher, NULL, (const u_char *)key,
(const u_char *)iv) != 1) (const u_char *)iv) != 1) {
errx(1, "OpenSSL %s (%zu) ctx init failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx init failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_set_padding(ctx, 0); EVP_CIPHER_CTX_set_padding(ctx, 0);
if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)input, if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)input,
size) != 1) size) != 1) {
errx(1, "OpenSSL %s (%zu) update failed: %s", warnx("OpenSSL %s (%zu) update failed: %s",
alg->name, size, ERR_error_string(ERR_get_error(), NULL)); alg->name, size, ERR_error_string(ERR_get_error(), NULL));
if (EVP_EncryptFinal_ex(ctx, NULL, &outl) != 1) goto error;
errx(1, "OpenSSL %s (%zu) final failed: %s", alg->name, }
if (EVP_EncryptFinal_ex(ctx, NULL, &outl) != 1) {
warnx("OpenSSL %s (%zu) final failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, alg->tag_len, if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, alg->tag_len,
tag) != 1) tag) != 1) {
errx(1, "OpenSSL %s (%zu) get tag failed: %s", alg->name, warnx("OpenSSL %s (%zu) get tag failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_CTX_free(ctx);
return (true);
error:
EVP_CIPHER_CTX_free(ctx);
return (false);
} }
static bool static bool
ocf_mac(const struct alg *alg, const char *input, size_t size, const char *key, ocf_mac(const struct alg *alg, const char *input, size_t size, const char *key,
size_t key_len, const char *iv, char *tag, int *cridp) size_t key_len, const char *iv, char *tag, int *cridp)
{ {
struct ocf_session ses; struct ocf_session ses;
struct session2_op sop; struct session2_op sop;
▲ Show 20 Lines • Show All 42 Lines • ▼ Show 20 Linesrun_gmac_test(const struct alg *alg, size_t size)
key_len = EVP_CIPHER_key_length(cipher); key_len = EVP_CIPHER_key_length(cipher);
iv_len = EVP_CIPHER_iv_length(cipher); iv_len = EVP_CIPHER_iv_length(cipher);
key = alloc_buffer(key_len); key = alloc_buffer(key_len);
iv = generate_iv(iv_len, alg); iv = generate_iv(iv_len, alg);
buffer = alloc_buffer(size); buffer = alloc_buffer(size);
/* OpenSSL GMAC. */ /* OpenSSL GMAC. */
openssl_gmac(alg, cipher, key, iv, buffer, size, control_tag); if (!openssl_gmac(alg, cipher, key, iv, buffer, size, control_tag))
goto out;
/* OCF GMAC. */ /* OCF GMAC. */
if (!ocf_mac(alg, buffer, size, key, key_len, iv, test_tag, &crid)) if (!ocf_mac(alg, buffer, size, key, key_len, iv, test_tag, &crid))
goto out; goto out;
if (memcmp(control_tag, test_tag, sizeof(control_tag)) != 0) { if (memcmp(control_tag, test_tag, sizeof(control_tag)) != 0) {
printf("%s (%zu) mismatch:\n", alg->name, size); printf("%s (%zu) mismatch:\n", alg->name, size);
printf("control:\n"); printf("control:\n");
hexdump(control_tag, sizeof(control_tag), NULL, 0); hexdump(control_tag, sizeof(control_tag), NULL, 0);
printf("test (cryptodev device %s):\n", crfind(crid)); printf("test (cryptodev device %s):\n", crfind(crid));
hexdump(test_tag, sizeof(test_tag), NULL, 0); hexdump(test_tag, sizeof(test_tag), NULL, 0);
goto out; goto out;
} }
if (verbose) if (verbose)
printf("%s (%zu) matched (cryptodev device %s)\n", printf("%s (%zu) matched (cryptodev device %s)\n",
alg->name, size, crfind(crid)); alg->name, size, crfind(crid));
out: out:
free(buffer); free(buffer);
free(iv); free(iv);
free(key); free(key);
} }
static void static bool
openssl_digest(const struct alg *alg, const char *key, u_int key_len, openssl_digest(const struct alg *alg, const char *key, u_int key_len,
const char *input, size_t size, char *tag, u_int tag_len) const char *input, size_t size, char *tag, u_int tag_len)
{ {
EVP_MD_CTX *mdctx; EVP_MD_CTX *mdctx;
EVP_PKEY *pkey; EVP_PKEY *pkey;
size_t len; size_t len;
pkey = EVP_PKEY_new_raw_private_key(alg->pkey, NULL, key, key_len); pkey = EVP_PKEY_new_raw_private_key(alg->pkey, NULL, key, key_len);
if (pkey == NULL) if (pkey == NULL) {
errx(1, "OpenSSL %s (%zu) pkey new failed: %s", alg->name, warnx("OpenSSL %s (%zu) pkey new failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
return (false);
}
mdctx = EVP_MD_CTX_new(); mdctx = EVP_MD_CTX_new();
if (mdctx == NULL) if (mdctx == NULL) {
errx(1, "OpenSSL %s (%zu) ctx new failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx new failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
if (EVP_DigestSignInit(mdctx, NULL, NULL, NULL, pkey) != 1) EVP_PKEY_free(pkey);
errx(1, "OpenSSL %s (%zu) digest sign init failed: %s", return (false);
}
if (EVP_DigestSignInit(mdctx, NULL, NULL, NULL, pkey) != 1) {
warnx("OpenSSL %s (%zu) digest sign init failed: %s",
alg->name, size, ERR_error_string(ERR_get_error(), NULL)); alg->name, size, ERR_error_string(ERR_get_error(), NULL));
if (EVP_DigestSignUpdate(mdctx, input, size) != 1) goto error;
errx(1, "OpenSSL %s (%zu) digest update failed: %s", alg->name, }
if (EVP_DigestSignUpdate(mdctx, input, size) != 1) {
warnx("OpenSSL %s (%zu) digest update failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
len = tag_len; len = tag_len;
if (EVP_DigestSignFinal(mdctx, tag, &len) != 1) if (EVP_DigestSignFinal(mdctx, tag, &len) != 1) {
errx(1, "OpenSSL %s (%zu) digest final failed: %s", alg->name, warnx("OpenSSL %s (%zu) digest final failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_MD_CTX_free(mdctx); EVP_MD_CTX_free(mdctx);
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
return (true);
error:
EVP_MD_CTX_free(mdctx);
EVP_PKEY_free(pkey);
return (false);
} }
static void static void
run_digest_test(const struct alg *alg, size_t size) run_digest_test(const struct alg *alg, size_t size)
{ {
char *key, *buffer; char *key, *buffer;
u_int key_len; u_int key_len;
int crid; int crid;
char control_tag[EVP_MAX_MD_SIZE], test_tag[EVP_MAX_MD_SIZE]; char control_tag[EVP_MAX_MD_SIZE], test_tag[EVP_MAX_MD_SIZE];
memset(control_tag, 0x3c, sizeof(control_tag)); memset(control_tag, 0x3c, sizeof(control_tag));
memset(test_tag, 0x3c, sizeof(test_tag)); memset(test_tag, 0x3c, sizeof(test_tag));
key_len = alg->key_len; key_len = alg->key_len;
key = alloc_buffer(key_len); key = alloc_buffer(key_len);
buffer = alloc_buffer(size); buffer = alloc_buffer(size);
/* OpenSSL Poly1305. */ /* OpenSSL Poly1305. */
openssl_digest(alg, key, key_len, buffer, size, control_tag, if (!openssl_digest(alg, key, key_len, buffer, size, control_tag,
sizeof(control_tag)); sizeof(control_tag)))
goto out;
/* OCF Poly1305. */ /* OCF Poly1305. */
if (!ocf_mac(alg, buffer, size, key, key_len, NULL, test_tag, &crid)) if (!ocf_mac(alg, buffer, size, key, key_len, NULL, test_tag, &crid))
goto out; goto out;
if (memcmp(control_tag, test_tag, sizeof(control_tag)) != 0) { if (memcmp(control_tag, test_tag, sizeof(control_tag)) != 0) {
printf("%s (%zu) mismatch:\n", alg->name, size); printf("%s (%zu) mismatch:\n", alg->name, size);
printf("control:\n"); printf("control:\n");
hexdump(control_tag, sizeof(control_tag), NULL, 0); hexdump(control_tag, sizeof(control_tag), NULL, 0);
printf("test (cryptodev device %s):\n", crfind(crid)); printf("test (cryptodev device %s):\n", crfind(crid));
hexdump(test_tag, sizeof(test_tag), NULL, 0); hexdump(test_tag, sizeof(test_tag), NULL, 0);
goto out; goto out;
} }
if (verbose) if (verbose)
printf("%s (%zu) matched (cryptodev device %s)\n", printf("%s (%zu) matched (cryptodev device %s)\n",
alg->name, size, crfind(crid)); alg->name, size, crfind(crid));
out: out:
free(buffer); free(buffer);
free(key); free(key);
} }
static void static bool
openssl_aead_encrypt(const struct alg *alg, const EVP_CIPHER *cipher, openssl_aead_encrypt(const struct alg *alg, const EVP_CIPHER *cipher,
const char *key, const char *iv, size_t iv_len, const char *aad, const char *key, const char *iv, size_t iv_len, const char *aad,
size_t aad_len, const char *input, char *output, size_t size, char *tag) size_t aad_len, const char *input, char *output, size_t size, char *tag)
{ {
EVP_CIPHER_CTX *ctx; EVP_CIPHER_CTX *ctx;
int outl, total; int outl, total;
ctx = EVP_CIPHER_CTX_new(); ctx = EVP_CIPHER_CTX_new();
if (ctx == NULL) if (ctx == NULL) {
errx(1, "OpenSSL %s (%zu) ctx new failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx new failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) return (false);
errx(1, "OpenSSL %s (%zu) ctx init failed: %s", alg->name, }
if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
warnx("OpenSSL %s (%zu) ctx init failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_len, NULL) != 1) goto error;
errx(1, "OpenSSL %s (%zu) setting iv length failed: %s", alg->name, }
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_len, NULL) !=
1) {
warnx("OpenSSL %s (%zu) setting iv length failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
if (EVP_EncryptInit_ex(ctx, NULL, NULL, (const u_char *)key, if (EVP_EncryptInit_ex(ctx, NULL, NULL, (const u_char *)key,
(const u_char *)iv) != 1) (const u_char *)iv) != 1) {
errx(1, "OpenSSL %s (%zu) ctx init failed: %s", alg->name, warnx("OpenSSL %s (%zu) ctx init failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_set_padding(ctx, 0); EVP_CIPHER_CTX_set_padding(ctx, 0);
if (aad != NULL) { if (aad != NULL) {
if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad, if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
aad_len) != 1) aad_len) != 1) {
errx(1, "OpenSSL %s (%zu) aad update failed: %s", warnx("OpenSSL %s (%zu) aad update failed: %s",
alg->name, size, alg->name, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
} }
}
if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl, if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl,
(const u_char *)input, size) != 1) (const u_char *)input, size) != 1) {
errx(1, "OpenSSL %s (%zu) encrypt update failed: %s", alg->name, warnx("OpenSSL %s (%zu) encrypt update failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total = outl; total = outl;
if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
errx(1, "OpenSSL %s (%zu) encrypt final failed: %s", alg->name, warnx("OpenSSL %s (%zu) encrypt final failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total += outl; total += outl;
if ((size_t)total != size) if ((size_t)total != size) {
errx(1, "OpenSSL %s (%zu) encrypt size mismatch: %d", alg->name, warnx("OpenSSL %s (%zu) encrypt size mismatch: %d", alg->name,
size, total); size, total);
goto error;
}
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, alg->tag_len, if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, alg->tag_len,
tag) != 1) tag) != 1) {
errx(1, "OpenSSL %s (%zu) get tag failed: %s", alg->name, warnx("OpenSSL %s (%zu) get tag failed: %s", alg->name,
size, ERR_error_string(ERR_get_error(), NULL)); size, ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_CTX_free(ctx);
return (true);
error:
EVP_CIPHER_CTX_free(ctx);
return (false);
} }
#ifdef notused #ifdef notused
static bool static bool
openssl_aead_decrypt(const struct alg *alg, const EVP_CIPHER *cipher, openssl_aead_decrypt(const struct alg *alg, const EVP_CIPHER *cipher,
const char *key, const char *iv, const char *aad, size_t aad_len, const char *key, const char *iv, const char *aad, size_t aad_len,
const char *input, char *output, size_t size, char *tag) const char *input, char *output, size_t size, char *tag)
{ {
Show All 31 Linesopenssl_aead_decrypt(const struct alg *alg, const EVP_CIPHER *cipher,
if (total != size) if (total != size)
errx(1, "OpenSSL %s (%zu) decrypt size mismatch: %d", alg->name, errx(1, "OpenSSL %s (%zu) decrypt size mismatch: %d", alg->name,
size, total); size, total);
EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_CTX_free(ctx);
return (valid); return (valid);
} }
#endif #endif
static void static bool
openssl_ccm_encrypt(const struct alg *alg, const EVP_CIPHER *cipher, openssl_ccm_encrypt(const struct alg *alg, const EVP_CIPHER *cipher,
const char *key, const char *iv, size_t iv_len, const char *aad, const char *key, const char *iv, size_t iv_len, const char *aad,
size_t aad_len, const char *input, char *output, size_t size, char *tag) size_t aad_len, const char *input, char *output, size_t size, char *tag)
{ {
EVP_CIPHER_CTX *ctx; EVP_CIPHER_CTX *ctx;
int outl, total; int outl, total;
ctx = EVP_CIPHER_CTX_new(); ctx = EVP_CIPHER_CTX_new();
if (ctx == NULL) if (ctx == NULL) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) ctx new failed: %s", warnx("OpenSSL %s/%zu (%zu, %zu) ctx new failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) return (false);
errx(1, "OpenSSL %s/%zu (%zu, %zu) ctx init failed: %s", }
if (EVP_EncryptInit_ex(ctx, cipher, NULL, NULL, NULL) != 1) {
warnx("OpenSSL %s/%zu (%zu, %zu) ctx init failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_len, NULL) != 1) goto error;
errx(1, }
"OpenSSL %s/%zu (%zu, %zu) setting iv length failed: %s", if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_len, NULL) !=
1) {
warnx("OpenSSL %s/%zu (%zu, %zu) setting iv length failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, AES_CBC_MAC_HASH_LEN, NULL) != 1) goto error;
errx(1, }
"OpenSSL %s/%zu (%zu, %zu) setting tag length failed: %s", if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, AES_CBC_MAC_HASH_LEN,
NULL) != 1) {
warnx("OpenSSL %s/%zu (%zu, %zu) setting tag length failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
}
if (EVP_EncryptInit_ex(ctx, NULL, NULL, (const u_char *)key, if (EVP_EncryptInit_ex(ctx, NULL, NULL, (const u_char *)key,
(const u_char *)iv) != 1) (const u_char *)iv) != 1) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) ctx init failed: %s", warnx("OpenSSL %s/%zu (%zu, %zu) ctx init failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
if (EVP_EncryptUpdate(ctx, NULL, &outl, NULL, size) != 1) goto error;
errx(1, }
"OpenSSL %s/%zu (%zu, %zu) unable to set data length: %s", if (EVP_EncryptUpdate(ctx, NULL, &outl, NULL, size) != 1) {
warnx("OpenSSL %s/%zu (%zu, %zu) unable to set data length: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
}
if (aad != NULL) { if (aad != NULL) {
if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad, if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
aad_len) != 1) aad_len) != 1) {
errx(1, warnx("OpenSSL %s/%zu (%zu, %zu) aad update failed: %s",
"OpenSSL %s/%zu (%zu, %zu) aad update failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
} }
}
if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl, if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl,
(const u_char *)input, size) != 1) (const u_char *)input, size) != 1) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) encrypt update failed: %s", warnx("OpenSSL %s/%zu (%zu, %zu) encrypt update failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total = outl; total = outl;
if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) encrypt final failed: %s", warnx("OpenSSL %s/%zu (%zu, %zu) encrypt final failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
}
total += outl; total += outl;
if ((size_t)total != size) if ((size_t)total != size) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) encrypt size mismatch: %d", warnx("OpenSSL %s/%zu (%zu, %zu) encrypt size mismatch: %d",
alg->name, iv_len, aad_len, size, total); alg->name, iv_len, aad_len, size, total);
goto error;
}
if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, AES_CBC_MAC_HASH_LEN, if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, AES_CBC_MAC_HASH_LEN,
tag) != 1) tag) != 1) {
errx(1, "OpenSSL %s/%zu (%zu, %zu) get tag failed: %s", warnx("OpenSSL %s/%zu (%zu, %zu) get tag failed: %s",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
goto error;
}
EVP_CIPHER_CTX_free(ctx); EVP_CIPHER_CTX_free(ctx);
return (true);
error:
EVP_CIPHER_CTX_free(ctx);
return (false);
} }
static bool static bool
ocf_init_aead_session(const struct alg *alg, const char *key, size_t key_len, ocf_init_aead_session(const struct alg *alg, const char *key, size_t key_len,
size_t iv_len, struct ocf_session *ses) size_t iv_len, struct ocf_session *ses)
{ {
struct session2_op sop; struct session2_op sop;
▲ Show 20 Lines • Show All 65 Lines • ▼ Show 20 Lines
{ {
struct ocf_session ses; struct ocf_session ses;
const EVP_CIPHER *cipher; const EVP_CIPHER *cipher;
char *aad, *buffer, *cleartext, *ciphertext; char *aad, *buffer, *cleartext, *ciphertext;
char *iv, *key; char *iv, *key;
u_int key_len; u_int key_len;
int error; int error;
char control_tag[AEAD_MAX_TAG_LEN], test_tag[AEAD_MAX_TAG_LEN]; char control_tag[AEAD_MAX_TAG_LEN], test_tag[AEAD_MAX_TAG_LEN];
bool ok;
cipher = alg->evp_cipher(); cipher = alg->evp_cipher();
if (size % EVP_CIPHER_block_size(cipher) != 0) { if (size % EVP_CIPHER_block_size(cipher) != 0) {
if (verbose) if (verbose)
printf( printf(
"%s/%zu (%zu, %zu): invalid buffer size (block size %d)\n", "%s/%zu (%zu, %zu): invalid buffer size (block size %d)\n",
alg->name, iv_len, aad_len, size, alg->name, iv_len, aad_len, size,
EVP_CIPHER_block_size(cipher)); EVP_CIPHER_block_size(cipher));
Show All 20 Linesrun_aead_test(const struct alg *alg, size_t aad_len, size_t size,
ciphertext = malloc(size); ciphertext = malloc(size);
if (aad_len != 0) if (aad_len != 0)
aad = alloc_buffer(aad_len); aad = alloc_buffer(aad_len);
else else
aad = NULL; aad = NULL;
/* OpenSSL encrypt */ /* OpenSSL encrypt */
if (EVP_CIPHER_mode(cipher) == EVP_CIPH_CCM_MODE) if (EVP_CIPHER_mode(cipher) == EVP_CIPH_CCM_MODE)
openssl_ccm_encrypt(alg, cipher, key, iv, iv_len, aad, ok = openssl_ccm_encrypt(alg, cipher, key, iv, iv_len, aad,
aad_len, cleartext, ciphertext, size, control_tag); aad_len, cleartext, ciphertext, size, control_tag);
else else
openssl_aead_encrypt(alg, cipher, key, iv, iv_len, aad, ok = openssl_aead_encrypt(alg, cipher, key, iv, iv_len, aad,
aad_len, cleartext, ciphertext, size, control_tag); aad_len, cleartext, ciphertext, size, control_tag);
if (!ok)
goto out_noocf;
if (!ocf_init_aead_session(alg, key, key_len, iv_len, &ses)) if (!ocf_init_aead_session(alg, key, key_len, iv_len, &ses))
goto out; goto out_noocf;
/* OCF encrypt */ /* OCF encrypt */
error = ocf_aead(&ses, iv, iv_len, aad, aad_len, cleartext, buffer, error = ocf_aead(&ses, iv, iv_len, aad, aad_len, cleartext, buffer,
size, test_tag, COP_ENCRYPT); size, test_tag, COP_ENCRYPT);
if (error != 0) { if (error != 0) {
warnc(error, "cryptodev %s/%zu (%zu, %zu) failed for device %s", warnc(error, "cryptodev %s/%zu (%zu, %zu) failed for device %s",
alg->name, iv_len, aad_len, size, crfind(ses.crid)); alg->name, iv_len, aad_len, size, crfind(ses.crid));
goto out; goto out;
▲ Show 20 Lines • Show All 52 Lines • ▼ Show 20 Linesrun_aead_test(const struct alg *alg, size_t aad_len, size_t size,
} }
if (verbose) if (verbose)
printf("%s/%zu (%zu, %zu) matched (cryptodev device %s)\n", printf("%s/%zu (%zu, %zu) matched (cryptodev device %s)\n",
alg->name, iv_len, aad_len, size, crfind(ses.crid)); alg->name, iv_len, aad_len, size, crfind(ses.crid));
out: out:
ocf_destroy_session(&ses); ocf_destroy_session(&ses);
out_noocf:
free(aad); free(aad);
free(ciphertext); free(ciphertext);
free(buffer); free(buffer);
free(cleartext); free(cleartext);
free(iv); free(iv);
free(key); free(key);
} }
▲ Show 20 Lines • Show All 295 Lines • Show Last 20 Lines