1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Authenc: Simple AEAD wrapper for IPsec
5 * Copyright (c) 2007-2015 Herbert Xu <herbert@gondor.apana.org.au>
8 #include <crypto/internal/aead.h>
9 #include <crypto/internal/hash.h>
10 #include <crypto/internal/skcipher.h>
11 #include <crypto/authenc.h>
12 #include <crypto/null.h>
13 #include <crypto/scatterwalk.h>
14 #include <linux/err.h>
15 #include <linux/init.h>
16 #include <linux/kernel.h>
17 #include <linux/module.h>
18 #include <linux/rtnetlink.h>
19 #include <linux/slab.h>
20 #include <linux/spinlock.h>
22 struct authenc_instance_ctx
{
23 struct crypto_ahash_spawn auth
;
24 struct crypto_skcipher_spawn enc
;
28 struct crypto_authenc_ctx
{
29 struct crypto_ahash
*auth
;
30 struct crypto_skcipher
*enc
;
31 struct crypto_sync_skcipher
*null
;
34 struct authenc_request_ctx
{
35 struct scatterlist src
[2];
36 struct scatterlist dst
[2];
40 static void authenc_request_complete(struct aead_request
*req
, int err
)
42 if (err
!= -EINPROGRESS
)
43 aead_request_complete(req
, err
);
46 int crypto_authenc_extractkeys(struct crypto_authenc_keys
*keys
, const u8
*key
,
49 struct rtattr
*rta
= (struct rtattr
*)key
;
50 struct crypto_authenc_key_param
*param
;
52 if (!RTA_OK(rta
, keylen
))
54 if (rta
->rta_type
!= CRYPTO_AUTHENC_KEYA_PARAM
)
58 * RTA_OK() didn't align the rtattr's payload when validating that it
59 * fits in the buffer. Yet, the keys should start on the next 4-byte
60 * aligned boundary. To avoid confusion, require that the rtattr
61 * payload be exactly the param struct, which has a 4-byte aligned size.
63 if (RTA_PAYLOAD(rta
) != sizeof(*param
))
65 BUILD_BUG_ON(sizeof(*param
) % RTA_ALIGNTO
);
67 param
= RTA_DATA(rta
);
68 keys
->enckeylen
= be32_to_cpu(param
->enckeylen
);
71 keylen
-= rta
->rta_len
;
73 if (keylen
< keys
->enckeylen
)
76 keys
->authkeylen
= keylen
- keys
->enckeylen
;
78 keys
->enckey
= key
+ keys
->authkeylen
;
82 EXPORT_SYMBOL_GPL(crypto_authenc_extractkeys
);
84 static int crypto_authenc_setkey(struct crypto_aead
*authenc
, const u8
*key
,
87 struct crypto_authenc_ctx
*ctx
= crypto_aead_ctx(authenc
);
88 struct crypto_ahash
*auth
= ctx
->auth
;
89 struct crypto_skcipher
*enc
= ctx
->enc
;
90 struct crypto_authenc_keys keys
;
93 if (crypto_authenc_extractkeys(&keys
, key
, keylen
) != 0)
96 crypto_ahash_clear_flags(auth
, CRYPTO_TFM_REQ_MASK
);
97 crypto_ahash_set_flags(auth
, crypto_aead_get_flags(authenc
) &
99 err
= crypto_ahash_setkey(auth
, keys
.authkey
, keys
.authkeylen
);
103 crypto_skcipher_clear_flags(enc
, CRYPTO_TFM_REQ_MASK
);
104 crypto_skcipher_set_flags(enc
, crypto_aead_get_flags(authenc
) &
105 CRYPTO_TFM_REQ_MASK
);
106 err
= crypto_skcipher_setkey(enc
, keys
.enckey
, keys
.enckeylen
);
108 memzero_explicit(&keys
, sizeof(keys
));
112 static void authenc_geniv_ahash_done(void *data
, int err
)
114 struct aead_request
*req
= data
;
115 struct crypto_aead
*authenc
= crypto_aead_reqtfm(req
);
116 struct aead_instance
*inst
= aead_alg_instance(authenc
);
117 struct authenc_instance_ctx
*ictx
= aead_instance_ctx(inst
);
118 struct authenc_request_ctx
*areq_ctx
= aead_request_ctx(req
);
119 struct ahash_request
*ahreq
= (void *)(areq_ctx
->tail
+ ictx
->reqoff
);
124 scatterwalk_map_and_copy(ahreq
->result
, req
->dst
,
125 req
->assoclen
+ req
->cryptlen
,
126 crypto_aead_authsize(authenc
), 1);
129 aead_request_complete(req
, err
);
132 static int crypto_authenc_genicv(struct aead_request
*req
, unsigned int flags
)
134 struct crypto_aead
*authenc
= crypto_aead_reqtfm(req
);
135 struct aead_instance
*inst
= aead_alg_instance(authenc
);
136 struct crypto_authenc_ctx
*ctx
= crypto_aead_ctx(authenc
);
137 struct authenc_instance_ctx
*ictx
= aead_instance_ctx(inst
);
138 struct crypto_ahash
*auth
= ctx
->auth
;
139 struct authenc_request_ctx
*areq_ctx
= aead_request_ctx(req
);
140 struct ahash_request
*ahreq
= (void *)(areq_ctx
->tail
+ ictx
->reqoff
);
141 u8
*hash
= areq_ctx
->tail
;
144 hash
= (u8
*)ALIGN((unsigned long)hash
+ crypto_ahash_alignmask(auth
),
145 crypto_ahash_alignmask(auth
) + 1);
147 ahash_request_set_tfm(ahreq
, auth
);
148 ahash_request_set_crypt(ahreq
, req
->dst
, hash
,
149 req
->assoclen
+ req
->cryptlen
);
150 ahash_request_set_callback(ahreq
, flags
,
151 authenc_geniv_ahash_done
, req
);
153 err
= crypto_ahash_digest(ahreq
);
157 scatterwalk_map_and_copy(hash
, req
->dst
, req
->assoclen
+ req
->cryptlen
,
158 crypto_aead_authsize(authenc
), 1);
163 static void crypto_authenc_encrypt_done(void *data
, int err
)
165 struct aead_request
*areq
= data
;
170 err
= crypto_authenc_genicv(areq
, 0);
173 authenc_request_complete(areq
, err
);
176 static int crypto_authenc_copy_assoc(struct aead_request
*req
)
178 struct crypto_aead
*authenc
= crypto_aead_reqtfm(req
);
179 struct crypto_authenc_ctx
*ctx
= crypto_aead_ctx(authenc
);
180 SYNC_SKCIPHER_REQUEST_ON_STACK(skreq
, ctx
->null
);
182 skcipher_request_set_sync_tfm(skreq
, ctx
->null
);
183 skcipher_request_set_callback(skreq
, aead_request_flags(req
),
185 skcipher_request_set_crypt(skreq
, req
->src
, req
->dst
, req
->assoclen
,
188 return crypto_skcipher_encrypt(skreq
);
191 static int crypto_authenc_encrypt(struct aead_request
*req
)
193 struct crypto_aead
*authenc
= crypto_aead_reqtfm(req
);
194 struct aead_instance
*inst
= aead_alg_instance(authenc
);
195 struct crypto_authenc_ctx
*ctx
= crypto_aead_ctx(authenc
);
196 struct authenc_instance_ctx
*ictx
= aead_instance_ctx(inst
);
197 struct authenc_request_ctx
*areq_ctx
= aead_request_ctx(req
);
198 struct crypto_skcipher
*enc
= ctx
->enc
;
199 unsigned int cryptlen
= req
->cryptlen
;
200 struct skcipher_request
*skreq
= (void *)(areq_ctx
->tail
+
202 struct scatterlist
*src
, *dst
;
205 src
= scatterwalk_ffwd(areq_ctx
->src
, req
->src
, req
->assoclen
);
208 if (req
->src
!= req
->dst
) {
209 err
= crypto_authenc_copy_assoc(req
);
213 dst
= scatterwalk_ffwd(areq_ctx
->dst
, req
->dst
, req
->assoclen
);
216 skcipher_request_set_tfm(skreq
, enc
);
217 skcipher_request_set_callback(skreq
, aead_request_flags(req
),
218 crypto_authenc_encrypt_done
, req
);
219 skcipher_request_set_crypt(skreq
, src
, dst
, cryptlen
, req
->iv
);
221 err
= crypto_skcipher_encrypt(skreq
);
225 return crypto_authenc_genicv(req
, aead_request_flags(req
));
228 static int crypto_authenc_decrypt_tail(struct aead_request
*req
,
231 struct crypto_aead
*authenc
= crypto_aead_reqtfm(req
);
232 struct aead_instance
*inst
= aead_alg_instance(authenc
);
233 struct crypto_authenc_ctx
*ctx
= crypto_aead_ctx(authenc
);
234 struct authenc_instance_ctx
*ictx
= aead_instance_ctx(inst
);
235 struct authenc_request_ctx
*areq_ctx
= aead_request_ctx(req
);
236 struct ahash_request
*ahreq
= (void *)(areq_ctx
->tail
+ ictx
->reqoff
);
237 struct skcipher_request
*skreq
= (void *)(areq_ctx
->tail
+
239 unsigned int authsize
= crypto_aead_authsize(authenc
);
240 u8
*ihash
= ahreq
->result
+ authsize
;
241 struct scatterlist
*src
, *dst
;
243 scatterwalk_map_and_copy(ihash
, req
->src
, ahreq
->nbytes
, authsize
, 0);
245 if (crypto_memneq(ihash
, ahreq
->result
, authsize
))
248 src
= scatterwalk_ffwd(areq_ctx
->src
, req
->src
, req
->assoclen
);
251 if (req
->src
!= req
->dst
)
252 dst
= scatterwalk_ffwd(areq_ctx
->dst
, req
->dst
, req
->assoclen
);
254 skcipher_request_set_tfm(skreq
, ctx
->enc
);
255 skcipher_request_set_callback(skreq
, flags
,
256 req
->base
.complete
, req
->base
.data
);
257 skcipher_request_set_crypt(skreq
, src
, dst
,
258 req
->cryptlen
- authsize
, req
->iv
);
260 return crypto_skcipher_decrypt(skreq
);
263 static void authenc_verify_ahash_done(void *data
, int err
)
265 struct aead_request
*req
= data
;
270 err
= crypto_authenc_decrypt_tail(req
, 0);
273 authenc_request_complete(req
, err
);
276 static int crypto_authenc_decrypt(struct aead_request
*req
)
278 struct crypto_aead
*authenc
= crypto_aead_reqtfm(req
);
279 unsigned int authsize
= crypto_aead_authsize(authenc
);
280 struct aead_instance
*inst
= aead_alg_instance(authenc
);
281 struct crypto_authenc_ctx
*ctx
= crypto_aead_ctx(authenc
);
282 struct authenc_instance_ctx
*ictx
= aead_instance_ctx(inst
);
283 struct crypto_ahash
*auth
= ctx
->auth
;
284 struct authenc_request_ctx
*areq_ctx
= aead_request_ctx(req
);
285 struct ahash_request
*ahreq
= (void *)(areq_ctx
->tail
+ ictx
->reqoff
);
286 u8
*hash
= areq_ctx
->tail
;
289 hash
= (u8
*)ALIGN((unsigned long)hash
+ crypto_ahash_alignmask(auth
),
290 crypto_ahash_alignmask(auth
) + 1);
292 ahash_request_set_tfm(ahreq
, auth
);
293 ahash_request_set_crypt(ahreq
, req
->src
, hash
,
294 req
->assoclen
+ req
->cryptlen
- authsize
);
295 ahash_request_set_callback(ahreq
, aead_request_flags(req
),
296 authenc_verify_ahash_done
, req
);
298 err
= crypto_ahash_digest(ahreq
);
302 return crypto_authenc_decrypt_tail(req
, aead_request_flags(req
));
305 static int crypto_authenc_init_tfm(struct crypto_aead
*tfm
)
307 struct aead_instance
*inst
= aead_alg_instance(tfm
);
308 struct authenc_instance_ctx
*ictx
= aead_instance_ctx(inst
);
309 struct crypto_authenc_ctx
*ctx
= crypto_aead_ctx(tfm
);
310 struct crypto_ahash
*auth
;
311 struct crypto_skcipher
*enc
;
312 struct crypto_sync_skcipher
*null
;
315 auth
= crypto_spawn_ahash(&ictx
->auth
);
317 return PTR_ERR(auth
);
319 enc
= crypto_spawn_skcipher(&ictx
->enc
);
324 null
= crypto_get_default_null_skcipher();
327 goto err_free_skcipher
;
333 crypto_aead_set_reqsize(
335 sizeof(struct authenc_request_ctx
) +
338 crypto_ahash_reqsize(auth
) +
339 sizeof(struct ahash_request
),
340 sizeof(struct skcipher_request
) +
341 crypto_skcipher_reqsize(enc
)));
346 crypto_free_skcipher(enc
);
348 crypto_free_ahash(auth
);
352 static void crypto_authenc_exit_tfm(struct crypto_aead
*tfm
)
354 struct crypto_authenc_ctx
*ctx
= crypto_aead_ctx(tfm
);
356 crypto_free_ahash(ctx
->auth
);
357 crypto_free_skcipher(ctx
->enc
);
358 crypto_put_default_null_skcipher();
361 static void crypto_authenc_free(struct aead_instance
*inst
)
363 struct authenc_instance_ctx
*ctx
= aead_instance_ctx(inst
);
365 crypto_drop_skcipher(&ctx
->enc
);
366 crypto_drop_ahash(&ctx
->auth
);
370 static int crypto_authenc_create(struct crypto_template
*tmpl
,
374 struct aead_instance
*inst
;
375 struct authenc_instance_ctx
*ctx
;
376 struct hash_alg_common
*auth
;
377 struct crypto_alg
*auth_base
;
378 struct skcipher_alg
*enc
;
381 err
= crypto_check_attr_type(tb
, CRYPTO_ALG_TYPE_AEAD
, &mask
);
385 inst
= kzalloc(sizeof(*inst
) + sizeof(*ctx
), GFP_KERNEL
);
388 ctx
= aead_instance_ctx(inst
);
390 err
= crypto_grab_ahash(&ctx
->auth
, aead_crypto_instance(inst
),
391 crypto_attr_alg_name(tb
[1]), 0, mask
);
394 auth
= crypto_spawn_ahash_alg(&ctx
->auth
);
395 auth_base
= &auth
->base
;
397 err
= crypto_grab_skcipher(&ctx
->enc
, aead_crypto_instance(inst
),
398 crypto_attr_alg_name(tb
[2]), 0, mask
);
401 enc
= crypto_spawn_skcipher_alg(&ctx
->enc
);
403 ctx
->reqoff
= ALIGN(2 * auth
->digestsize
+ auth_base
->cra_alignmask
,
404 auth_base
->cra_alignmask
+ 1);
407 if (snprintf(inst
->alg
.base
.cra_name
, CRYPTO_MAX_ALG_NAME
,
408 "authenc(%s,%s)", auth_base
->cra_name
,
409 enc
->base
.cra_name
) >=
413 if (snprintf(inst
->alg
.base
.cra_driver_name
, CRYPTO_MAX_ALG_NAME
,
414 "authenc(%s,%s)", auth_base
->cra_driver_name
,
415 enc
->base
.cra_driver_name
) >= CRYPTO_MAX_ALG_NAME
)
418 inst
->alg
.base
.cra_priority
= enc
->base
.cra_priority
* 10 +
419 auth_base
->cra_priority
;
420 inst
->alg
.base
.cra_blocksize
= enc
->base
.cra_blocksize
;
421 inst
->alg
.base
.cra_alignmask
= auth_base
->cra_alignmask
|
422 enc
->base
.cra_alignmask
;
423 inst
->alg
.base
.cra_ctxsize
= sizeof(struct crypto_authenc_ctx
);
425 inst
->alg
.ivsize
= crypto_skcipher_alg_ivsize(enc
);
426 inst
->alg
.chunksize
= crypto_skcipher_alg_chunksize(enc
);
427 inst
->alg
.maxauthsize
= auth
->digestsize
;
429 inst
->alg
.init
= crypto_authenc_init_tfm
;
430 inst
->alg
.exit
= crypto_authenc_exit_tfm
;
432 inst
->alg
.setkey
= crypto_authenc_setkey
;
433 inst
->alg
.encrypt
= crypto_authenc_encrypt
;
434 inst
->alg
.decrypt
= crypto_authenc_decrypt
;
436 inst
->free
= crypto_authenc_free
;
438 err
= aead_register_instance(tmpl
, inst
);
441 crypto_authenc_free(inst
);
446 static struct crypto_template crypto_authenc_tmpl
= {
448 .create
= crypto_authenc_create
,
449 .module
= THIS_MODULE
,
452 static int __init
crypto_authenc_module_init(void)
454 return crypto_register_template(&crypto_authenc_tmpl
);
457 static void __exit
crypto_authenc_module_exit(void)
459 crypto_unregister_template(&crypto_authenc_tmpl
);
462 subsys_initcall(crypto_authenc_module_init
);
463 module_exit(crypto_authenc_module_exit
);
465 MODULE_LICENSE("GPL");
466 MODULE_DESCRIPTION("Simple AEAD wrapper for IPsec");
467 MODULE_ALIAS_CRYPTO("authenc");