1 // SPDX-License-Identifier: GPL-2.0-only
3 * Crypto user configuration API.
5 * Copyright (C) 2011 secunet Security Networks AG
6 * Copyright (C) 2011 Steffen Klassert <steffen.klassert@secunet.com>
9 #include <linux/module.h>
10 #include <linux/crypto.h>
11 #include <linux/cryptouser.h>
12 #include <linux/sched.h>
13 #include <net/netlink.h>
14 #include <linux/security.h>
15 #include <net/net_namespace.h>
16 #include <crypto/internal/skcipher.h>
17 #include <crypto/internal/rng.h>
18 #include <crypto/akcipher.h>
19 #include <crypto/kpp.h>
20 #include <crypto/internal/cryptouser.h>
24 #define null_terminated(x) (strnlen(x, sizeof(x)) < sizeof(x))
26 static DEFINE_MUTEX(crypto_cfg_mutex
);
28 /* The crypto netlink socket */
29 struct sock
*crypto_nlsk
;
31 struct crypto_dump_info
{
32 struct sk_buff
*in_skb
;
33 struct sk_buff
*out_skb
;
38 struct crypto_alg
*crypto_alg_match(struct crypto_user_alg
*p
, int exact
)
40 struct crypto_alg
*q
, *alg
= NULL
;
42 down_read(&crypto_alg_sem
);
44 list_for_each_entry(q
, &crypto_alg_list
, cra_list
) {
47 if ((q
->cra_flags
^ p
->cru_type
) & p
->cru_mask
)
50 if (strlen(p
->cru_driver_name
))
51 match
= !strcmp(q
->cra_driver_name
,
54 match
= !strcmp(q
->cra_name
, p
->cru_name
);
59 if (unlikely(!crypto_mod_get(q
)))
66 up_read(&crypto_alg_sem
);
71 static int crypto_report_cipher(struct sk_buff
*skb
, struct crypto_alg
*alg
)
73 struct crypto_report_cipher rcipher
;
75 memset(&rcipher
, 0, sizeof(rcipher
));
77 strscpy(rcipher
.type
, "cipher", sizeof(rcipher
.type
));
79 rcipher
.blocksize
= alg
->cra_blocksize
;
80 rcipher
.min_keysize
= alg
->cra_cipher
.cia_min_keysize
;
81 rcipher
.max_keysize
= alg
->cra_cipher
.cia_max_keysize
;
83 return nla_put(skb
, CRYPTOCFGA_REPORT_CIPHER
,
84 sizeof(rcipher
), &rcipher
);
87 static int crypto_report_comp(struct sk_buff
*skb
, struct crypto_alg
*alg
)
89 struct crypto_report_comp rcomp
;
91 memset(&rcomp
, 0, sizeof(rcomp
));
93 strscpy(rcomp
.type
, "compression", sizeof(rcomp
.type
));
95 return nla_put(skb
, CRYPTOCFGA_REPORT_COMPRESS
, sizeof(rcomp
), &rcomp
);
98 static int crypto_report_one(struct crypto_alg
*alg
,
99 struct crypto_user_alg
*ualg
, struct sk_buff
*skb
)
101 memset(ualg
, 0, sizeof(*ualg
));
103 strscpy(ualg
->cru_name
, alg
->cra_name
, sizeof(ualg
->cru_name
));
104 strscpy(ualg
->cru_driver_name
, alg
->cra_driver_name
,
105 sizeof(ualg
->cru_driver_name
));
106 strscpy(ualg
->cru_module_name
, module_name(alg
->cra_module
),
107 sizeof(ualg
->cru_module_name
));
111 ualg
->cru_flags
= alg
->cra_flags
;
112 ualg
->cru_refcnt
= refcount_read(&alg
->cra_refcnt
);
114 if (nla_put_u32(skb
, CRYPTOCFGA_PRIORITY_VAL
, alg
->cra_priority
))
115 goto nla_put_failure
;
116 if (alg
->cra_flags
& CRYPTO_ALG_LARVAL
) {
117 struct crypto_report_larval rl
;
119 memset(&rl
, 0, sizeof(rl
));
120 strscpy(rl
.type
, "larval", sizeof(rl
.type
));
121 if (nla_put(skb
, CRYPTOCFGA_REPORT_LARVAL
, sizeof(rl
), &rl
))
122 goto nla_put_failure
;
126 if (alg
->cra_type
&& alg
->cra_type
->report
) {
127 if (alg
->cra_type
->report(skb
, alg
))
128 goto nla_put_failure
;
133 switch (alg
->cra_flags
& (CRYPTO_ALG_TYPE_MASK
| CRYPTO_ALG_LARVAL
)) {
134 case CRYPTO_ALG_TYPE_CIPHER
:
135 if (crypto_report_cipher(skb
, alg
))
136 goto nla_put_failure
;
139 case CRYPTO_ALG_TYPE_COMPRESS
:
140 if (crypto_report_comp(skb
, alg
))
141 goto nla_put_failure
;
153 static int crypto_report_alg(struct crypto_alg
*alg
,
154 struct crypto_dump_info
*info
)
156 struct sk_buff
*in_skb
= info
->in_skb
;
157 struct sk_buff
*skb
= info
->out_skb
;
158 struct nlmsghdr
*nlh
;
159 struct crypto_user_alg
*ualg
;
162 nlh
= nlmsg_put(skb
, NETLINK_CB(in_skb
).portid
, info
->nlmsg_seq
,
163 CRYPTO_MSG_GETALG
, sizeof(*ualg
), info
->nlmsg_flags
);
169 ualg
= nlmsg_data(nlh
);
171 err
= crypto_report_one(alg
, ualg
, skb
);
173 nlmsg_cancel(skb
, nlh
);
183 static int crypto_report(struct sk_buff
*in_skb
, struct nlmsghdr
*in_nlh
,
184 struct nlattr
**attrs
)
186 struct crypto_user_alg
*p
= nlmsg_data(in_nlh
);
187 struct crypto_alg
*alg
;
189 struct crypto_dump_info info
;
192 if (!null_terminated(p
->cru_name
) || !null_terminated(p
->cru_driver_name
))
195 alg
= crypto_alg_match(p
, 0);
200 skb
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
204 info
.in_skb
= in_skb
;
206 info
.nlmsg_seq
= in_nlh
->nlmsg_seq
;
207 info
.nlmsg_flags
= 0;
209 err
= crypto_report_alg(alg
, &info
);
217 return nlmsg_unicast(crypto_nlsk
, skb
, NETLINK_CB(in_skb
).portid
);
220 static int crypto_dump_report(struct sk_buff
*skb
, struct netlink_callback
*cb
)
222 const size_t start_pos
= cb
->args
[0];
224 struct crypto_dump_info info
;
225 struct crypto_alg
*alg
;
228 info
.in_skb
= cb
->skb
;
230 info
.nlmsg_seq
= cb
->nlh
->nlmsg_seq
;
231 info
.nlmsg_flags
= NLM_F_MULTI
;
233 down_read(&crypto_alg_sem
);
234 list_for_each_entry(alg
, &crypto_alg_list
, cra_list
) {
235 if (pos
>= start_pos
) {
236 res
= crypto_report_alg(alg
, &info
);
237 if (res
== -EMSGSIZE
)
247 up_read(&crypto_alg_sem
);
251 static int crypto_dump_report_done(struct netlink_callback
*cb
)
256 static int crypto_update_alg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
257 struct nlattr
**attrs
)
259 struct crypto_alg
*alg
;
260 struct crypto_user_alg
*p
= nlmsg_data(nlh
);
261 struct nlattr
*priority
= attrs
[CRYPTOCFGA_PRIORITY_VAL
];
264 if (!netlink_capable(skb
, CAP_NET_ADMIN
))
267 if (!null_terminated(p
->cru_name
) || !null_terminated(p
->cru_driver_name
))
270 if (priority
&& !strlen(p
->cru_driver_name
))
273 alg
= crypto_alg_match(p
, 1);
277 down_write(&crypto_alg_sem
);
279 crypto_remove_spawns(alg
, &list
, NULL
);
282 alg
->cra_priority
= nla_get_u32(priority
);
284 up_write(&crypto_alg_sem
);
287 crypto_remove_final(&list
);
292 static int crypto_del_alg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
293 struct nlattr
**attrs
)
295 struct crypto_alg
*alg
;
296 struct crypto_user_alg
*p
= nlmsg_data(nlh
);
299 if (!netlink_capable(skb
, CAP_NET_ADMIN
))
302 if (!null_terminated(p
->cru_name
) || !null_terminated(p
->cru_driver_name
))
305 alg
= crypto_alg_match(p
, 1);
309 /* We can not unregister core algorithms such as aes-generic.
310 * We would loose the reference in the crypto_alg_list to this algorithm
311 * if we try to unregister. Unregistering such an algorithm without
312 * removing the module is not possible, so we restrict to crypto
313 * instances that are build from templates. */
315 if (!(alg
->cra_flags
& CRYPTO_ALG_INSTANCE
))
319 if (refcount_read(&alg
->cra_refcnt
) > 2)
322 err
= crypto_unregister_instance((struct crypto_instance
*)alg
);
329 static int crypto_add_alg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
330 struct nlattr
**attrs
)
334 struct crypto_alg
*alg
;
335 struct crypto_user_alg
*p
= nlmsg_data(nlh
);
336 struct nlattr
*priority
= attrs
[CRYPTOCFGA_PRIORITY_VAL
];
338 if (!netlink_capable(skb
, CAP_NET_ADMIN
))
341 if (!null_terminated(p
->cru_name
) || !null_terminated(p
->cru_driver_name
))
344 if (strlen(p
->cru_driver_name
))
347 if (priority
&& !exact
)
350 alg
= crypto_alg_match(p
, exact
);
356 if (strlen(p
->cru_driver_name
))
357 name
= p
->cru_driver_name
;
361 alg
= crypto_alg_mod_lookup(name
, p
->cru_type
, p
->cru_mask
);
365 down_write(&crypto_alg_sem
);
368 alg
->cra_priority
= nla_get_u32(priority
);
370 up_write(&crypto_alg_sem
);
377 static int crypto_del_rng(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
378 struct nlattr
**attrs
)
380 if (!netlink_capable(skb
, CAP_NET_ADMIN
))
382 return crypto_del_default_rng();
385 #define MSGSIZE(type) sizeof(struct type)
387 static const int crypto_msg_min
[CRYPTO_NR_MSGTYPES
] = {
388 [CRYPTO_MSG_NEWALG
- CRYPTO_MSG_BASE
] = MSGSIZE(crypto_user_alg
),
389 [CRYPTO_MSG_DELALG
- CRYPTO_MSG_BASE
] = MSGSIZE(crypto_user_alg
),
390 [CRYPTO_MSG_UPDATEALG
- CRYPTO_MSG_BASE
] = MSGSIZE(crypto_user_alg
),
391 [CRYPTO_MSG_GETALG
- CRYPTO_MSG_BASE
] = MSGSIZE(crypto_user_alg
),
392 [CRYPTO_MSG_DELRNG
- CRYPTO_MSG_BASE
] = 0,
393 [CRYPTO_MSG_GETSTAT
- CRYPTO_MSG_BASE
] = MSGSIZE(crypto_user_alg
),
396 static const struct nla_policy crypto_policy
[CRYPTOCFGA_MAX
+1] = {
397 [CRYPTOCFGA_PRIORITY_VAL
] = { .type
= NLA_U32
},
402 static const struct crypto_link
{
403 int (*doit
)(struct sk_buff
*, struct nlmsghdr
*, struct nlattr
**);
404 int (*dump
)(struct sk_buff
*, struct netlink_callback
*);
405 int (*done
)(struct netlink_callback
*);
406 } crypto_dispatch
[CRYPTO_NR_MSGTYPES
] = {
407 [CRYPTO_MSG_NEWALG
- CRYPTO_MSG_BASE
] = { .doit
= crypto_add_alg
},
408 [CRYPTO_MSG_DELALG
- CRYPTO_MSG_BASE
] = { .doit
= crypto_del_alg
},
409 [CRYPTO_MSG_UPDATEALG
- CRYPTO_MSG_BASE
] = { .doit
= crypto_update_alg
},
410 [CRYPTO_MSG_GETALG
- CRYPTO_MSG_BASE
] = { .doit
= crypto_report
,
411 .dump
= crypto_dump_report
,
412 .done
= crypto_dump_report_done
},
413 [CRYPTO_MSG_DELRNG
- CRYPTO_MSG_BASE
] = { .doit
= crypto_del_rng
},
414 [CRYPTO_MSG_GETSTAT
- CRYPTO_MSG_BASE
] = { .doit
= crypto_reportstat
},
417 static int crypto_user_rcv_msg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
418 struct netlink_ext_ack
*extack
)
420 struct nlattr
*attrs
[CRYPTOCFGA_MAX
+1];
421 const struct crypto_link
*link
;
424 type
= nlh
->nlmsg_type
;
425 if (type
> CRYPTO_MSG_MAX
)
428 type
-= CRYPTO_MSG_BASE
;
429 link
= &crypto_dispatch
[type
];
431 if ((type
== (CRYPTO_MSG_GETALG
- CRYPTO_MSG_BASE
) &&
432 (nlh
->nlmsg_flags
& NLM_F_DUMP
))) {
433 struct crypto_alg
*alg
;
434 unsigned long dump_alloc
= 0;
436 if (link
->dump
== NULL
)
439 down_read(&crypto_alg_sem
);
440 list_for_each_entry(alg
, &crypto_alg_list
, cra_list
)
441 dump_alloc
+= CRYPTO_REPORT_MAXSIZE
;
442 up_read(&crypto_alg_sem
);
445 struct netlink_dump_control c
= {
448 .min_dump_alloc
= min(dump_alloc
, 65535UL),
450 err
= netlink_dump_start(crypto_nlsk
, skb
, nlh
, &c
);
456 err
= nlmsg_parse_deprecated(nlh
, crypto_msg_min
[type
], attrs
,
457 CRYPTOCFGA_MAX
, crypto_policy
, extack
);
461 if (link
->doit
== NULL
)
464 return link
->doit(skb
, nlh
, attrs
);
467 static void crypto_netlink_rcv(struct sk_buff
*skb
)
469 mutex_lock(&crypto_cfg_mutex
);
470 netlink_rcv_skb(skb
, &crypto_user_rcv_msg
);
471 mutex_unlock(&crypto_cfg_mutex
);
474 static int __init
crypto_user_init(void)
476 struct netlink_kernel_cfg cfg
= {
477 .input
= crypto_netlink_rcv
,
480 crypto_nlsk
= netlink_kernel_create(&init_net
, NETLINK_CRYPTO
, &cfg
);
487 static void __exit
crypto_user_exit(void)
489 netlink_kernel_release(crypto_nlsk
);
492 module_init(crypto_user_init
);
493 module_exit(crypto_user_exit
);
494 MODULE_LICENSE("GPL");
495 MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
496 MODULE_DESCRIPTION("Crypto userspace configuration API");
497 MODULE_ALIAS("net-pf-16-proto-21");