[thirdparty/kernel/stable.git] / crypto / hmac.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Cryptographic API.
 *
 * HMAC: Keyed-Hashing for Message Authentication (RFC2104).
 *
 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
 * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
 *
 * The HMAC implementation is derived from USAGI.
 * Copyright (c) 2002 Kazunori Miyazawa <miyazawa@linux-ipv6.org> / USAGI
 */

#include <crypto/hmac.h>
#include <crypto/internal/hash.h>
#include <crypto/scatterwalk.h>
#include <linux/err.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/scatterlist.h>
#include <linux/string.h>

struct hmac_ctx {
	struct crypto_shash *hash;
};

static inline void *align_ptr(void *p, unsigned int align)
{
	return (void *)ALIGN((unsigned long)p, align);
}

static inline struct hmac_ctx *hmac_ctx(struct crypto_shash *tfm)
{
	return align_ptr(crypto_shash_ctx_aligned(tfm) +
			 crypto_shash_statesize(tfm) * 2,
			 crypto_tfm_ctx_alignment());
}

static int hmac_setkey(struct crypto_shash *parent,
		       const u8 *inkey, unsigned int keylen)
{
	int bs = crypto_shash_blocksize(parent);
	int ds = crypto_shash_digestsize(parent);
	int ss = crypto_shash_statesize(parent);
	char *ipad = crypto_shash_ctx_aligned(parent);
	char *opad = ipad + ss;
	struct hmac_ctx *ctx = align_ptr(opad + ss,
					 crypto_tfm_ctx_alignment());
	struct crypto_shash *hash = ctx->hash;
	SHASH_DESC_ON_STACK(shash, hash);
	unsigned int i;

	shash->tfm = hash;

	if (keylen > bs) {
		int err;

		err = crypto_shash_digest(shash, inkey, keylen, ipad);
		if (err)
			return err;

		keylen = ds;
	} else
		memcpy(ipad, inkey, keylen);

	memset(ipad + keylen, 0, bs - keylen);
	memcpy(opad, ipad, bs);

	for (i = 0; i < bs; i++) {
		ipad[i] ^= HMAC_IPAD_VALUE;
		opad[i] ^= HMAC_OPAD_VALUE;
	}

	return crypto_shash_init(shash) ?:
	       crypto_shash_update(shash, ipad, bs) ?:
	       crypto_shash_export(shash, ipad) ?:
	       crypto_shash_init(shash) ?:
	       crypto_shash_update(shash, opad, bs) ?:
	       crypto_shash_export(shash, opad);
}

static int hmac_export(struct shash_desc *pdesc, void *out)
{
	struct shash_desc *desc = shash_desc_ctx(pdesc);

	return crypto_shash_export(desc, out);
}

static int hmac_import(struct shash_desc *pdesc, const void *in)
{
	struct shash_desc *desc = shash_desc_ctx(pdesc);
	struct hmac_ctx *ctx = hmac_ctx(pdesc->tfm);

	desc->tfm = ctx->hash;

	return crypto_shash_import(desc, in);
}

static int hmac_init(struct shash_desc *pdesc)
{
	return hmac_import(pdesc, crypto_shash_ctx_aligned(pdesc->tfm));
}

static int hmac_update(struct shash_desc *pdesc,
		       const u8 *data, unsigned int nbytes)
{
	struct shash_desc *desc = shash_desc_ctx(pdesc);

	return crypto_shash_update(desc, data, nbytes);
}

static int hmac_final(struct shash_desc *pdesc, u8 *out)
{
	struct crypto_shash *parent = pdesc->tfm;
	int ds = crypto_shash_digestsize(parent);
	int ss = crypto_shash_statesize(parent);
	char *opad = crypto_shash_ctx_aligned(parent) + ss;
	struct shash_desc *desc = shash_desc_ctx(pdesc);

	return crypto_shash_final(desc, out) ?:
	       crypto_shash_import(desc, opad) ?:
	       crypto_shash_finup(desc, out, ds, out);
}

static int hmac_finup(struct shash_desc *pdesc, const u8 *data,
		      unsigned int nbytes, u8 *out)
{

	struct crypto_shash *parent = pdesc->tfm;
	int ds = crypto_shash_digestsize(parent);
	int ss = crypto_shash_statesize(parent);
	char *opad = crypto_shash_ctx_aligned(parent) + ss;
	struct shash_desc *desc = shash_desc_ctx(pdesc);

	return crypto_shash_finup(desc, data, nbytes, out) ?:
	       crypto_shash_import(desc, opad) ?:
	       crypto_shash_finup(desc, out, ds, out);
}

static int hmac_init_tfm(struct crypto_tfm *tfm)
{
	struct crypto_shash *parent = __crypto_shash_cast(tfm);
	struct crypto_shash *hash;
	struct crypto_instance *inst = (void *)tfm->__crt_alg;
	struct crypto_shash_spawn *spawn = crypto_instance_ctx(inst);
	struct hmac_ctx *ctx = hmac_ctx(parent);

	hash = crypto_spawn_shash(spawn);
	if (IS_ERR(hash))
		return PTR_ERR(hash);

	parent->descsize = sizeof(struct shash_desc) +
			   crypto_shash_descsize(hash);
	if (WARN_ON(parent->descsize > HASH_MAX_DESCSIZE)) {
		crypto_free_shash(hash);
		return -EINVAL;
	}

	ctx->hash = hash;
	return 0;
}

static void hmac_exit_tfm(struct crypto_tfm *tfm)
{
	struct hmac_ctx *ctx = hmac_ctx(__crypto_shash_cast(tfm));
	crypto_free_shash(ctx->hash);
}

static int hmac_create(struct crypto_template *tmpl, struct rtattr **tb)
{
	struct shash_instance *inst;
	struct crypto_alg *alg;
	struct shash_alg *salg;
	int err;
	int ds;
	int ss;

	err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SHASH);
	if (err)
		return err;

	salg = shash_attr_alg(tb[1], 0, 0);
	if (IS_ERR(salg))
		return PTR_ERR(salg);
	alg = &salg->base;

	/* The underlying hash algorithm must be unkeyed */
	err = -EINVAL;
	if (crypto_shash_alg_has_setkey(salg))
		goto out_put_alg;

	ds = salg->digestsize;
	ss = salg->statesize;
	if (ds > alg->cra_blocksize ||
	    ss < alg->cra_blocksize)
		goto out_put_alg;

	inst = shash_alloc_instance("hmac", alg);
	err = PTR_ERR(inst);
	if (IS_ERR(inst))
		goto out_put_alg;

	err = crypto_init_shash_spawn(shash_instance_ctx(inst), salg,
				      shash_crypto_instance(inst));
	if (err)
		goto out_free_inst;

	inst->alg.base.cra_priority = alg->cra_priority;
	inst->alg.base.cra_blocksize = alg->cra_blocksize;
	inst->alg.base.cra_alignmask = alg->cra_alignmask;

	ss = ALIGN(ss, alg->cra_alignmask + 1);
	inst->alg.digestsize = ds;
	inst->alg.statesize = ss;

	inst->alg.base.cra_ctxsize = sizeof(struct hmac_ctx) +
				     ALIGN(ss * 2, crypto_tfm_ctx_alignment());

	inst->alg.base.cra_init = hmac_init_tfm;
	inst->alg.base.cra_exit = hmac_exit_tfm;

	inst->alg.init = hmac_init;
	inst->alg.update = hmac_update;
	inst->alg.final = hmac_final;
	inst->alg.finup = hmac_finup;
	inst->alg.export = hmac_export;
	inst->alg.import = hmac_import;
	inst->alg.setkey = hmac_setkey;

	err = shash_register_instance(tmpl, inst);
	if (err) {
out_free_inst:
		shash_free_instance(shash_crypto_instance(inst));
	}

out_put_alg:
	crypto_mod_put(alg);
	return err;
}

static struct crypto_template hmac_tmpl = {
	.name = "hmac",
	.create = hmac_create,
	.free = shash_free_instance,
	.module = THIS_MODULE,
};

static int __init hmac_module_init(void)
{
	return crypto_register_template(&hmac_tmpl);
}

static void __exit hmac_module_exit(void)
{
	crypto_unregister_template(&hmac_tmpl);
}

subsys_initcall(hmac_module_init);
module_exit(hmac_module_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("HMAC hash algorithm");
MODULE_ALIAS_CRYPTO("hmac");
Commit	Line	Data
	1	// SPDX-License-Identifier: GPL-2.0-or-later
	2	/*
	3	* Cryptographic API.
	4	*
	5	* HMAC: Keyed-Hashing for Message Authentication (RFC2104).
	6	*
	7	* Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
	8	* Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
	9	*
	10	* The HMAC implementation is derived from USAGI.
	11	* Copyright (c) 2002 Kazunori Miyazawa <miyazawa@linux-ipv6.org> / USAGI
	12	*/
	13
	14	#include <crypto/hmac.h>
	15	#include <crypto/internal/hash.h>
	16	#include <crypto/scatterwalk.h>
	17	#include <linux/err.h>
	18	#include <linux/init.h>
	19	#include <linux/kernel.h>
	20	#include <linux/module.h>
	21	#include <linux/scatterlist.h>
	22	#include <linux/string.h>
	23
	24	struct hmac_ctx {
	25	struct crypto_shash *hash;
	26	};
	27
	28	static inline void align_ptr(void p, unsigned int align)
	29	{
	30	return (void *)ALIGN((unsigned long)p, align);
	31	}
	32
	33	static inline struct hmac_ctx hmac_ctx(struct crypto_shash tfm)
	34	{
	35	return align_ptr(crypto_shash_ctx_aligned(tfm) +
	36	crypto_shash_statesize(tfm) * 2,
	37	crypto_tfm_ctx_alignment());
	38	}
	39
	40	static int hmac_setkey(struct crypto_shash *parent,
	41	const u8 *inkey, unsigned int keylen)
	42	{
	43	int bs = crypto_shash_blocksize(parent);
	44	int ds = crypto_shash_digestsize(parent);
	45	int ss = crypto_shash_statesize(parent);
	46	char *ipad = crypto_shash_ctx_aligned(parent);
	47	char *opad = ipad + ss;
	48	struct hmac_ctx *ctx = align_ptr(opad + ss,
	49	crypto_tfm_ctx_alignment());
	50	struct crypto_shash *hash = ctx->hash;
	51	SHASH_DESC_ON_STACK(shash, hash);
	52	unsigned int i;
	53
	54	shash->tfm = hash;
	55
	56	if (keylen > bs) {
	57	int err;
	58
	59	err = crypto_shash_digest(shash, inkey, keylen, ipad);
	60	if (err)
	61	return err;
	62
	63	keylen = ds;
	64	} else
	65	memcpy(ipad, inkey, keylen);
	66
	67	memset(ipad + keylen, 0, bs - keylen);
	68	memcpy(opad, ipad, bs);
	69
	70	for (i = 0; i < bs; i++) {
	71	ipad[i] ^= HMAC_IPAD_VALUE;
	72	opad[i] ^= HMAC_OPAD_VALUE;
	73	}
	74
	75	return crypto_shash_init(shash) ?:
	76	crypto_shash_update(shash, ipad, bs) ?:
	77	crypto_shash_export(shash, ipad) ?:
	78	crypto_shash_init(shash) ?:
	79	crypto_shash_update(shash, opad, bs) ?:
	80	crypto_shash_export(shash, opad);
	81	}
	82
	83	static int hmac_export(struct shash_desc pdesc, void out)
	84	{
	85	struct shash_desc *desc = shash_desc_ctx(pdesc);
	86
	87	return crypto_shash_export(desc, out);
	88	}
	89
	90	static int hmac_import(struct shash_desc pdesc, const void in)
	91	{
	92	struct shash_desc *desc = shash_desc_ctx(pdesc);
	93	struct hmac_ctx *ctx = hmac_ctx(pdesc->tfm);
	94
	95	desc->tfm = ctx->hash;
	96
	97	return crypto_shash_import(desc, in);
	98	}
	99
	100	static int hmac_init(struct shash_desc *pdesc)
	101	{
	102	return hmac_import(pdesc, crypto_shash_ctx_aligned(pdesc->tfm));
	103	}
	104
	105	static int hmac_update(struct shash_desc *pdesc,
	106	const u8 *data, unsigned int nbytes)
	107	{
	108	struct shash_desc *desc = shash_desc_ctx(pdesc);
	109
	110	return crypto_shash_update(desc, data, nbytes);
	111	}
	112
	113	static int hmac_final(struct shash_desc pdesc, u8 out)
	114	{
	115	struct crypto_shash *parent = pdesc->tfm;
	116	int ds = crypto_shash_digestsize(parent);
	117	int ss = crypto_shash_statesize(parent);
	118	char *opad = crypto_shash_ctx_aligned(parent) + ss;
	119	struct shash_desc *desc = shash_desc_ctx(pdesc);
	120
	121	return crypto_shash_final(desc, out) ?:
	122	crypto_shash_import(desc, opad) ?:
	123	crypto_shash_finup(desc, out, ds, out);
	124	}
	125
	126	static int hmac_finup(struct shash_desc pdesc, const u8 data,
	127	unsigned int nbytes, u8 *out)
	128	{
	129
	130	struct crypto_shash *parent = pdesc->tfm;
	131	int ds = crypto_shash_digestsize(parent);
	132	int ss = crypto_shash_statesize(parent);
	133	char *opad = crypto_shash_ctx_aligned(parent) + ss;
	134	struct shash_desc *desc = shash_desc_ctx(pdesc);
	135
	136	return crypto_shash_finup(desc, data, nbytes, out) ?:
	137	crypto_shash_import(desc, opad) ?:
	138	crypto_shash_finup(desc, out, ds, out);
	139	}
	140
	141	static int hmac_init_tfm(struct crypto_tfm *tfm)
	142	{
	143	struct crypto_shash *parent = __crypto_shash_cast(tfm);
	144	struct crypto_shash *hash;
	145	struct crypto_instance inst = (void )tfm->__crt_alg;
	146	struct crypto_shash_spawn *spawn = crypto_instance_ctx(inst);
	147	struct hmac_ctx *ctx = hmac_ctx(parent);
	148
	149	hash = crypto_spawn_shash(spawn);
	150	if (IS_ERR(hash))
	151	return PTR_ERR(hash);
	152
	153	parent->descsize = sizeof(struct shash_desc) +
	154	crypto_shash_descsize(hash);
	155	if (WARN_ON(parent->descsize > HASH_MAX_DESCSIZE)) {
	156	crypto_free_shash(hash);
	157	return -EINVAL;
	158	}
	159
	160	ctx->hash = hash;
	161	return 0;
	162	}
	163
	164	static void hmac_exit_tfm(struct crypto_tfm *tfm)
	165	{
	166	struct hmac_ctx *ctx = hmac_ctx(__crypto_shash_cast(tfm));
	167	crypto_free_shash(ctx->hash);
	168	}
	169
	170	static int hmac_create(struct crypto_template tmpl, struct rtattr *tb)
	171	{
	172	struct shash_instance *inst;
	173	struct crypto_alg *alg;
	174	struct shash_alg *salg;
	175	int err;
	176	int ds;
	177	int ss;
	178
	179	err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SHASH);
	180	if (err)
	181	return err;
	182
	183	salg = shash_attr_alg(tb[1], 0, 0);
	184	if (IS_ERR(salg))
	185	return PTR_ERR(salg);
	186	alg = &salg->base;
	187
	188	/* The underlying hash algorithm must be unkeyed */
	189	err = -EINVAL;
	190	if (crypto_shash_alg_has_setkey(salg))
	191	goto out_put_alg;
	192
	193	ds = salg->digestsize;
	194	ss = salg->statesize;
	195	if (ds > alg->cra_blocksize \|\|
	196	ss < alg->cra_blocksize)
	197	goto out_put_alg;
	198
	199	inst = shash_alloc_instance("hmac", alg);
	200	err = PTR_ERR(inst);
	201	if (IS_ERR(inst))
	202	goto out_put_alg;
	203
	204	err = crypto_init_shash_spawn(shash_instance_ctx(inst), salg,
	205	shash_crypto_instance(inst));
	206	if (err)
	207	goto out_free_inst;
	208
	209	inst->alg.base.cra_priority = alg->cra_priority;
	210	inst->alg.base.cra_blocksize = alg->cra_blocksize;
	211	inst->alg.base.cra_alignmask = alg->cra_alignmask;
	212
	213	ss = ALIGN(ss, alg->cra_alignmask + 1);
	214	inst->alg.digestsize = ds;
	215	inst->alg.statesize = ss;
	216
	217	inst->alg.base.cra_ctxsize = sizeof(struct hmac_ctx) +
	218	ALIGN(ss * 2, crypto_tfm_ctx_alignment());
	219
	220	inst->alg.base.cra_init = hmac_init_tfm;
	221	inst->alg.base.cra_exit = hmac_exit_tfm;
	222
	223	inst->alg.init = hmac_init;
	224	inst->alg.update = hmac_update;
	225	inst->alg.final = hmac_final;
	226	inst->alg.finup = hmac_finup;
	227	inst->alg.export = hmac_export;
	228	inst->alg.import = hmac_import;
	229	inst->alg.setkey = hmac_setkey;
	230
	231	err = shash_register_instance(tmpl, inst);
	232	if (err) {
	233	out_free_inst:
	234	shash_free_instance(shash_crypto_instance(inst));
	235	}
	236
	237	out_put_alg:
	238	crypto_mod_put(alg);
	239	return err;
	240	}
	241
	242	static struct crypto_template hmac_tmpl = {
	243	.name = "hmac",
	244	.create = hmac_create,
	245	.free = shash_free_instance,
	246	.module = THIS_MODULE,
	247	};
	248
	249	static int __init hmac_module_init(void)
	250	{
	251	return crypto_register_template(&hmac_tmpl);
	252	}
	253
	254	static void __exit hmac_module_exit(void)
	255	{
	256	crypto_unregister_template(&hmac_tmpl);
	257	}
	258
	259	subsys_initcall(hmac_module_init);
	260	module_exit(hmac_module_exit);
	261
	262	MODULE_LICENSE("GPL");
	263	MODULE_DESCRIPTION("HMAC hash algorithm");
	264	MODULE_ALIAS_CRYPTO("hmac");