1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * authencesn.c - AEAD wrapper for IPsec with extended sequence numbers,
4 * derived from authenc.c
6 * Copyright (C) 2010 secunet Security Networks AG
7 * Copyright (C) 2010 Steffen Klassert <steffen.klassert@secunet.com>
8 * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
11 #include <crypto/internal/aead.h>
12 #include <crypto/internal/hash.h>
13 #include <crypto/internal/skcipher.h>
14 #include <crypto/authenc.h>
15 #include <crypto/null.h>
16 #include <crypto/scatterwalk.h>
17 #include <linux/err.h>
18 #include <linux/init.h>
19 #include <linux/kernel.h>
20 #include <linux/module.h>
21 #include <linux/rtnetlink.h>
22 #include <linux/slab.h>
23 #include <linux/spinlock.h>
25 struct authenc_esn_instance_ctx
{
26 struct crypto_ahash_spawn auth
;
27 struct crypto_skcipher_spawn enc
;
30 struct crypto_authenc_esn_ctx
{
32 struct crypto_ahash
*auth
;
33 struct crypto_skcipher
*enc
;
34 struct crypto_sync_skcipher
*null
;
37 struct authenc_esn_request_ctx
{
38 struct scatterlist src
[2];
39 struct scatterlist dst
[2];
43 static void authenc_esn_request_complete(struct aead_request
*req
, int err
)
45 if (err
!= -EINPROGRESS
)
46 aead_request_complete(req
, err
);
49 static int crypto_authenc_esn_setauthsize(struct crypto_aead
*authenc_esn
,
50 unsigned int authsize
)
52 if (authsize
> 0 && authsize
< 4)
58 static int crypto_authenc_esn_setkey(struct crypto_aead
*authenc_esn
, const u8
*key
,
61 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
62 struct crypto_ahash
*auth
= ctx
->auth
;
63 struct crypto_skcipher
*enc
= ctx
->enc
;
64 struct crypto_authenc_keys keys
;
67 if (crypto_authenc_extractkeys(&keys
, key
, keylen
) != 0)
70 crypto_ahash_clear_flags(auth
, CRYPTO_TFM_REQ_MASK
);
71 crypto_ahash_set_flags(auth
, crypto_aead_get_flags(authenc_esn
) &
73 err
= crypto_ahash_setkey(auth
, keys
.authkey
, keys
.authkeylen
);
77 crypto_skcipher_clear_flags(enc
, CRYPTO_TFM_REQ_MASK
);
78 crypto_skcipher_set_flags(enc
, crypto_aead_get_flags(authenc_esn
) &
80 err
= crypto_skcipher_setkey(enc
, keys
.enckey
, keys
.enckeylen
);
82 memzero_explicit(&keys
, sizeof(keys
));
86 static int crypto_authenc_esn_genicv_tail(struct aead_request
*req
,
89 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
90 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
91 struct authenc_esn_request_ctx
*areq_ctx
= aead_request_ctx(req
);
92 struct crypto_ahash
*auth
= ctx
->auth
;
93 u8
*hash
= PTR_ALIGN((u8
*)areq_ctx
->tail
,
94 crypto_ahash_alignmask(auth
) + 1);
95 unsigned int authsize
= crypto_aead_authsize(authenc_esn
);
96 unsigned int assoclen
= req
->assoclen
;
97 unsigned int cryptlen
= req
->cryptlen
;
98 struct scatterlist
*dst
= req
->dst
;
101 /* Move high-order bits of sequence number back. */
102 scatterwalk_map_and_copy(tmp
, dst
, 4, 4, 0);
103 scatterwalk_map_and_copy(tmp
+ 1, dst
, assoclen
+ cryptlen
, 4, 0);
104 scatterwalk_map_and_copy(tmp
, dst
, 0, 8, 1);
106 scatterwalk_map_and_copy(hash
, dst
, assoclen
+ cryptlen
, authsize
, 1);
110 static void authenc_esn_geniv_ahash_done(void *data
, int err
)
112 struct aead_request
*req
= data
;
114 err
= err
?: crypto_authenc_esn_genicv_tail(req
, 0);
115 aead_request_complete(req
, err
);
118 static int crypto_authenc_esn_genicv(struct aead_request
*req
,
121 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
122 struct authenc_esn_request_ctx
*areq_ctx
= aead_request_ctx(req
);
123 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
124 struct crypto_ahash
*auth
= ctx
->auth
;
125 u8
*hash
= PTR_ALIGN((u8
*)areq_ctx
->tail
,
126 crypto_ahash_alignmask(auth
) + 1);
127 struct ahash_request
*ahreq
= (void *)(areq_ctx
->tail
+ ctx
->reqoff
);
128 unsigned int authsize
= crypto_aead_authsize(authenc_esn
);
129 unsigned int assoclen
= req
->assoclen
;
130 unsigned int cryptlen
= req
->cryptlen
;
131 struct scatterlist
*dst
= req
->dst
;
137 /* Move high-order bits of sequence number to the end. */
138 scatterwalk_map_and_copy(tmp
, dst
, 0, 8, 0);
139 scatterwalk_map_and_copy(tmp
, dst
, 4, 4, 1);
140 scatterwalk_map_and_copy(tmp
+ 1, dst
, assoclen
+ cryptlen
, 4, 1);
142 sg_init_table(areq_ctx
->dst
, 2);
143 dst
= scatterwalk_ffwd(areq_ctx
->dst
, dst
, 4);
145 ahash_request_set_tfm(ahreq
, auth
);
146 ahash_request_set_crypt(ahreq
, dst
, hash
, assoclen
+ cryptlen
);
147 ahash_request_set_callback(ahreq
, flags
,
148 authenc_esn_geniv_ahash_done
, req
);
150 return crypto_ahash_digest(ahreq
) ?:
151 crypto_authenc_esn_genicv_tail(req
, aead_request_flags(req
));
155 static void crypto_authenc_esn_encrypt_done(void *data
, int err
)
157 struct aead_request
*areq
= data
;
160 err
= crypto_authenc_esn_genicv(areq
, 0);
162 authenc_esn_request_complete(areq
, err
);
165 static int crypto_authenc_esn_copy(struct aead_request
*req
, unsigned int len
)
167 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
168 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
169 SYNC_SKCIPHER_REQUEST_ON_STACK(skreq
, ctx
->null
);
171 skcipher_request_set_sync_tfm(skreq
, ctx
->null
);
172 skcipher_request_set_callback(skreq
, aead_request_flags(req
),
174 skcipher_request_set_crypt(skreq
, req
->src
, req
->dst
, len
, NULL
);
176 return crypto_skcipher_encrypt(skreq
);
179 static int crypto_authenc_esn_encrypt(struct aead_request
*req
)
181 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
182 struct authenc_esn_request_ctx
*areq_ctx
= aead_request_ctx(req
);
183 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
184 struct skcipher_request
*skreq
= (void *)(areq_ctx
->tail
+
186 struct crypto_skcipher
*enc
= ctx
->enc
;
187 unsigned int assoclen
= req
->assoclen
;
188 unsigned int cryptlen
= req
->cryptlen
;
189 struct scatterlist
*src
, *dst
;
192 sg_init_table(areq_ctx
->src
, 2);
193 src
= scatterwalk_ffwd(areq_ctx
->src
, req
->src
, assoclen
);
196 if (req
->src
!= req
->dst
) {
197 err
= crypto_authenc_esn_copy(req
, assoclen
);
201 sg_init_table(areq_ctx
->dst
, 2);
202 dst
= scatterwalk_ffwd(areq_ctx
->dst
, req
->dst
, assoclen
);
205 skcipher_request_set_tfm(skreq
, enc
);
206 skcipher_request_set_callback(skreq
, aead_request_flags(req
),
207 crypto_authenc_esn_encrypt_done
, req
);
208 skcipher_request_set_crypt(skreq
, src
, dst
, cryptlen
, req
->iv
);
210 err
= crypto_skcipher_encrypt(skreq
);
214 return crypto_authenc_esn_genicv(req
, aead_request_flags(req
));
217 static int crypto_authenc_esn_decrypt_tail(struct aead_request
*req
,
220 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
221 unsigned int authsize
= crypto_aead_authsize(authenc_esn
);
222 struct authenc_esn_request_ctx
*areq_ctx
= aead_request_ctx(req
);
223 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
224 struct skcipher_request
*skreq
= (void *)(areq_ctx
->tail
+
226 struct crypto_ahash
*auth
= ctx
->auth
;
227 u8
*ohash
= PTR_ALIGN((u8
*)areq_ctx
->tail
,
228 crypto_ahash_alignmask(auth
) + 1);
229 unsigned int cryptlen
= req
->cryptlen
- authsize
;
230 unsigned int assoclen
= req
->assoclen
;
231 struct scatterlist
*dst
= req
->dst
;
232 u8
*ihash
= ohash
+ crypto_ahash_digestsize(auth
);
238 /* Move high-order bits of sequence number back. */
239 scatterwalk_map_and_copy(tmp
, dst
, 4, 4, 0);
240 scatterwalk_map_and_copy(tmp
+ 1, dst
, assoclen
+ cryptlen
, 4, 0);
241 scatterwalk_map_and_copy(tmp
, dst
, 0, 8, 1);
243 if (crypto_memneq(ihash
, ohash
, authsize
))
248 sg_init_table(areq_ctx
->dst
, 2);
249 dst
= scatterwalk_ffwd(areq_ctx
->dst
, dst
, assoclen
);
251 skcipher_request_set_tfm(skreq
, ctx
->enc
);
252 skcipher_request_set_callback(skreq
, flags
,
253 req
->base
.complete
, req
->base
.data
);
254 skcipher_request_set_crypt(skreq
, dst
, dst
, cryptlen
, req
->iv
);
256 return crypto_skcipher_decrypt(skreq
);
259 static void authenc_esn_verify_ahash_done(void *data
, int err
)
261 struct aead_request
*req
= data
;
263 err
= err
?: crypto_authenc_esn_decrypt_tail(req
, 0);
264 authenc_esn_request_complete(req
, err
);
267 static int crypto_authenc_esn_decrypt(struct aead_request
*req
)
269 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
270 struct authenc_esn_request_ctx
*areq_ctx
= aead_request_ctx(req
);
271 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
272 struct ahash_request
*ahreq
= (void *)(areq_ctx
->tail
+ ctx
->reqoff
);
273 unsigned int authsize
= crypto_aead_authsize(authenc_esn
);
274 struct crypto_ahash
*auth
= ctx
->auth
;
275 u8
*ohash
= PTR_ALIGN((u8
*)areq_ctx
->tail
,
276 crypto_ahash_alignmask(auth
) + 1);
277 unsigned int assoclen
= req
->assoclen
;
278 unsigned int cryptlen
= req
->cryptlen
;
279 u8
*ihash
= ohash
+ crypto_ahash_digestsize(auth
);
280 struct scatterlist
*dst
= req
->dst
;
284 cryptlen
-= authsize
;
286 if (req
->src
!= dst
) {
287 err
= crypto_authenc_esn_copy(req
, assoclen
+ cryptlen
);
292 scatterwalk_map_and_copy(ihash
, req
->src
, assoclen
+ cryptlen
,
298 /* Move high-order bits of sequence number to the end. */
299 scatterwalk_map_and_copy(tmp
, dst
, 0, 8, 0);
300 scatterwalk_map_and_copy(tmp
, dst
, 4, 4, 1);
301 scatterwalk_map_and_copy(tmp
+ 1, dst
, assoclen
+ cryptlen
, 4, 1);
303 sg_init_table(areq_ctx
->dst
, 2);
304 dst
= scatterwalk_ffwd(areq_ctx
->dst
, dst
, 4);
306 ahash_request_set_tfm(ahreq
, auth
);
307 ahash_request_set_crypt(ahreq
, dst
, ohash
, assoclen
+ cryptlen
);
308 ahash_request_set_callback(ahreq
, aead_request_flags(req
),
309 authenc_esn_verify_ahash_done
, req
);
311 err
= crypto_ahash_digest(ahreq
);
316 return crypto_authenc_esn_decrypt_tail(req
, aead_request_flags(req
));
319 static int crypto_authenc_esn_init_tfm(struct crypto_aead
*tfm
)
321 struct aead_instance
*inst
= aead_alg_instance(tfm
);
322 struct authenc_esn_instance_ctx
*ictx
= aead_instance_ctx(inst
);
323 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(tfm
);
324 struct crypto_ahash
*auth
;
325 struct crypto_skcipher
*enc
;
326 struct crypto_sync_skcipher
*null
;
329 auth
= crypto_spawn_ahash(&ictx
->auth
);
331 return PTR_ERR(auth
);
333 enc
= crypto_spawn_skcipher(&ictx
->enc
);
338 null
= crypto_get_default_null_skcipher();
341 goto err_free_skcipher
;
347 ctx
->reqoff
= ALIGN(2 * crypto_ahash_digestsize(auth
),
348 crypto_ahash_alignmask(auth
) + 1);
350 crypto_aead_set_reqsize(
352 sizeof(struct authenc_esn_request_ctx
) +
355 crypto_ahash_reqsize(auth
) +
356 sizeof(struct ahash_request
),
357 sizeof(struct skcipher_request
) +
358 crypto_skcipher_reqsize(enc
)));
363 crypto_free_skcipher(enc
);
365 crypto_free_ahash(auth
);
369 static void crypto_authenc_esn_exit_tfm(struct crypto_aead
*tfm
)
371 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(tfm
);
373 crypto_free_ahash(ctx
->auth
);
374 crypto_free_skcipher(ctx
->enc
);
375 crypto_put_default_null_skcipher();
378 static void crypto_authenc_esn_free(struct aead_instance
*inst
)
380 struct authenc_esn_instance_ctx
*ctx
= aead_instance_ctx(inst
);
382 crypto_drop_skcipher(&ctx
->enc
);
383 crypto_drop_ahash(&ctx
->auth
);
387 static int crypto_authenc_esn_create(struct crypto_template
*tmpl
,
391 struct aead_instance
*inst
;
392 struct authenc_esn_instance_ctx
*ctx
;
393 struct hash_alg_common
*auth
;
394 struct crypto_alg
*auth_base
;
395 struct skcipher_alg
*enc
;
398 err
= crypto_check_attr_type(tb
, CRYPTO_ALG_TYPE_AEAD
, &mask
);
402 inst
= kzalloc(sizeof(*inst
) + sizeof(*ctx
), GFP_KERNEL
);
405 ctx
= aead_instance_ctx(inst
);
407 err
= crypto_grab_ahash(&ctx
->auth
, aead_crypto_instance(inst
),
408 crypto_attr_alg_name(tb
[1]), 0, mask
);
411 auth
= crypto_spawn_ahash_alg(&ctx
->auth
);
412 auth_base
= &auth
->base
;
414 err
= crypto_grab_skcipher(&ctx
->enc
, aead_crypto_instance(inst
),
415 crypto_attr_alg_name(tb
[2]), 0, mask
);
418 enc
= crypto_spawn_skcipher_alg(&ctx
->enc
);
421 if (snprintf(inst
->alg
.base
.cra_name
, CRYPTO_MAX_ALG_NAME
,
422 "authencesn(%s,%s)", auth_base
->cra_name
,
423 enc
->base
.cra_name
) >= CRYPTO_MAX_ALG_NAME
)
426 if (snprintf(inst
->alg
.base
.cra_driver_name
, CRYPTO_MAX_ALG_NAME
,
427 "authencesn(%s,%s)", auth_base
->cra_driver_name
,
428 enc
->base
.cra_driver_name
) >= CRYPTO_MAX_ALG_NAME
)
431 inst
->alg
.base
.cra_priority
= enc
->base
.cra_priority
* 10 +
432 auth_base
->cra_priority
;
433 inst
->alg
.base
.cra_blocksize
= enc
->base
.cra_blocksize
;
434 inst
->alg
.base
.cra_alignmask
= auth_base
->cra_alignmask
|
435 enc
->base
.cra_alignmask
;
436 inst
->alg
.base
.cra_ctxsize
= sizeof(struct crypto_authenc_esn_ctx
);
438 inst
->alg
.ivsize
= crypto_skcipher_alg_ivsize(enc
);
439 inst
->alg
.chunksize
= crypto_skcipher_alg_chunksize(enc
);
440 inst
->alg
.maxauthsize
= auth
->digestsize
;
442 inst
->alg
.init
= crypto_authenc_esn_init_tfm
;
443 inst
->alg
.exit
= crypto_authenc_esn_exit_tfm
;
445 inst
->alg
.setkey
= crypto_authenc_esn_setkey
;
446 inst
->alg
.setauthsize
= crypto_authenc_esn_setauthsize
;
447 inst
->alg
.encrypt
= crypto_authenc_esn_encrypt
;
448 inst
->alg
.decrypt
= crypto_authenc_esn_decrypt
;
450 inst
->free
= crypto_authenc_esn_free
;
452 err
= aead_register_instance(tmpl
, inst
);
455 crypto_authenc_esn_free(inst
);
460 static struct crypto_template crypto_authenc_esn_tmpl
= {
461 .name
= "authencesn",
462 .create
= crypto_authenc_esn_create
,
463 .module
= THIS_MODULE
,
466 static int __init
crypto_authenc_esn_module_init(void)
468 return crypto_register_template(&crypto_authenc_esn_tmpl
);
471 static void __exit
crypto_authenc_esn_module_exit(void)
473 crypto_unregister_template(&crypto_authenc_esn_tmpl
);
476 subsys_initcall(crypto_authenc_esn_module_init
);
477 module_exit(crypto_authenc_esn_module_exit
);
479 MODULE_LICENSE("GPL");
480 MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
481 MODULE_DESCRIPTION("AEAD wrapper for IPsec with extended sequence numbers");
482 MODULE_ALIAS_CRYPTO("authencesn");