1 /* $FreeBSD: src/sys/opencrypto/cryptosoft.c,v 1.2.2.1 2002/11/21 23:34:23 sam Exp $ */ 2 /* $OpenBSD: cryptosoft.c,v 1.35 2002/04/26 08:43:50 deraadt Exp $ */ 3 4 /* 5 * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu) 6 * 7 * This code was written by Angelos D. Keromytis in Athens, Greece, in 8 * February 2000. Network Security Technologies Inc. (NSTI) kindly 9 * supported the development of this code. 10 * 11 * Copyright (c) 2000, 2001 Angelos D. Keromytis 12 * 13 * Permission to use, copy, and modify this software with or without fee 14 * is hereby granted, provided that this entire notice is included in 15 * all source code copies of any software which is or includes a copy or 16 * modification of this software. 17 * 18 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 19 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 20 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 21 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 22 * PURPOSE. 23 */ 24 25 #include <sys/param.h> 26 #include <sys/systm.h> 27 #include <sys/malloc.h> 28 #include <sys/mbuf.h> 29 #include <sys/sysctl.h> 30 #include <sys/errno.h> 31 #include <sys/random.h> 32 #include <sys/kernel.h> 33 #include <sys/uio.h> 34 35 #include <crypto/blowfish/blowfish.h> 36 #include <crypto/cast128/cast128.h> 37 #include <crypto/sha1.h> 38 #include <opencrypto/rmd160.h> 39 #include <opencrypto/skipjack.h> 40 #include <sys/md5.h> 41 42 #include <opencrypto/cryptodev.h> 43 #include <opencrypto/cryptosoft.h> 44 #include <opencrypto/xform.h> 45 46 u_int8_t hmac_ipad_buffer[64] = { 47 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 48 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 49 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 50 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 51 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 52 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 53 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 54 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36 55 }; 56 57 u_int8_t hmac_opad_buffer[64] = { 58 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 59 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 60 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 61 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 62 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 63 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 64 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 65 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C 66 }; 67 68 69 struct swcr_data **swcr_sessions = NULL; 70 u_int32_t swcr_sesnum = 0; 71 int32_t swcr_id = -1; 72 73 #define COPYBACK(x, a, b, c, d) \ 74 (x) == CRYPTO_BUF_MBUF ? m_copyback((struct mbuf *)a,b,c,d) \ 75 : cuio_copyback((struct uio *)a,b,c,d) 76 #define COPYDATA(x, a, b, c, d) \ 77 (x) == CRYPTO_BUF_MBUF ? m_copydata((struct mbuf *)a,b,c,d) \ 78 : cuio_copydata((struct uio *)a,b,c,d) 79 80 static int swcr_encdec(struct cryptodesc *, struct swcr_data *, caddr_t, int); 81 static int swcr_authcompute(struct cryptop *crp, struct cryptodesc *crd, 82 struct swcr_data *sw, caddr_t buf, int outtype); 83 static int swcr_compdec(struct cryptodesc *, struct swcr_data *, caddr_t, int); 84 static int swcr_process(void *, struct cryptop *, int); 85 static int swcr_newsession(void *, u_int32_t *, struct cryptoini *); 86 static int swcr_freesession(void *, u_int64_t); 87 88 /* 89 * NB: These came over from openbsd and are kept private 90 * to the crypto code for now. 91 */ 92 extern int m_apply(struct mbuf *m, int off, int len, 93 int (*f)(caddr_t, caddr_t, unsigned int), caddr_t fstate); 94 95 /* 96 * Apply a symmetric encryption/decryption algorithm. 97 */ 98 static int 99 swcr_encdec(struct cryptodesc *crd, struct swcr_data *sw, caddr_t buf, 100 int outtype) 101 { 102 unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN], *idat; 103 unsigned char *ivp, piv[EALG_MAX_BLOCK_LEN]; 104 struct enc_xform *exf; 105 int i, k, j, blks; 106 107 exf = sw->sw_exf; 108 blks = exf->blocksize; 109 110 /* Check for non-padded data */ 111 if (crd->crd_len % blks) 112 return EINVAL; 113 114 /* Initialize the IV */ 115 if (crd->crd_flags & CRD_F_ENCRYPT) { 116 /* IV explicitly provided ? */ 117 if (crd->crd_flags & CRD_F_IV_EXPLICIT) 118 bcopy(crd->crd_iv, iv, blks); 119 else { 120 /* Get random IV */ 121 for (i = 0; 122 i + sizeof (u_int32_t) < EALG_MAX_BLOCK_LEN; 123 i += sizeof (u_int32_t)) { 124 u_int32_t temp = arc4random(); 125 126 bcopy(&temp, iv + i, sizeof(u_int32_t)); 127 } 128 /* 129 * What if the block size is not a multiple 130 * of sizeof (u_int32_t), which is the size of 131 * what arc4random() returns ? 132 */ 133 if (EALG_MAX_BLOCK_LEN % sizeof (u_int32_t) != 0) { 134 u_int32_t temp = arc4random(); 135 136 bcopy (&temp, iv + i, 137 EALG_MAX_BLOCK_LEN - i); 138 } 139 } 140 141 /* Do we need to write the IV */ 142 if (!(crd->crd_flags & CRD_F_IV_PRESENT)) { 143 COPYBACK(outtype, buf, crd->crd_inject, blks, iv); 144 } 145 146 } else { /* Decryption */ 147 /* IV explicitly provided ? */ 148 if (crd->crd_flags & CRD_F_IV_EXPLICIT) 149 bcopy(crd->crd_iv, iv, blks); 150 else { 151 /* Get IV off buf */ 152 COPYDATA(outtype, buf, crd->crd_inject, blks, iv); 153 } 154 } 155 156 ivp = iv; 157 158 if (outtype == CRYPTO_BUF_CONTIG) { 159 if (crd->crd_flags & CRD_F_ENCRYPT) { 160 for (i = crd->crd_skip; 161 i < crd->crd_skip + crd->crd_len; i += blks) { 162 /* XOR with the IV/previous block, as appropriate. */ 163 if (i == crd->crd_skip) 164 for (k = 0; k < blks; k++) 165 buf[i + k] ^= ivp[k]; 166 else 167 for (k = 0; k < blks; k++) 168 buf[i + k] ^= buf[i + k - blks]; 169 exf->encrypt(sw->sw_kschedule, buf + i); 170 } 171 } else { /* Decrypt */ 172 /* 173 * Start at the end, so we don't need to keep the encrypted 174 * block as the IV for the next block. 175 */ 176 for (i = crd->crd_skip + crd->crd_len - blks; 177 i >= crd->crd_skip; i -= blks) { 178 exf->decrypt(sw->sw_kschedule, buf + i); 179 180 /* XOR with the IV/previous block, as appropriate */ 181 if (i == crd->crd_skip) 182 for (k = 0; k < blks; k++) 183 buf[i + k] ^= ivp[k]; 184 else 185 for (k = 0; k < blks; k++) 186 buf[i + k] ^= buf[i + k - blks]; 187 } 188 } 189 190 return 0; 191 } else if (outtype == CRYPTO_BUF_MBUF) { 192 struct mbuf *m = (struct mbuf *) buf; 193 194 /* Find beginning of data */ 195 m = m_getptr(m, crd->crd_skip, &k); 196 if (m == NULL) 197 return EINVAL; 198 199 i = crd->crd_len; 200 201 while (i > 0) { 202 /* 203 * If there's insufficient data at the end of 204 * an mbuf, we have to do some copying. 205 */ 206 if (m->m_len < k + blks && m->m_len != k) { 207 m_copydata(m, k, blks, blk); 208 209 /* Actual encryption/decryption */ 210 if (crd->crd_flags & CRD_F_ENCRYPT) { 211 /* XOR with previous block */ 212 for (j = 0; j < blks; j++) 213 blk[j] ^= ivp[j]; 214 215 exf->encrypt(sw->sw_kschedule, blk); 216 217 /* 218 * Keep encrypted block for XOR'ing 219 * with next block 220 */ 221 bcopy(blk, iv, blks); 222 ivp = iv; 223 } else { /* decrypt */ 224 /* 225 * Keep encrypted block for XOR'ing 226 * with next block 227 */ 228 if (ivp == iv) 229 bcopy(blk, piv, blks); 230 else 231 bcopy(blk, iv, blks); 232 233 exf->decrypt(sw->sw_kschedule, blk); 234 235 /* XOR with previous block */ 236 for (j = 0; j < blks; j++) 237 blk[j] ^= ivp[j]; 238 239 if (ivp == iv) 240 bcopy(piv, iv, blks); 241 else 242 ivp = iv; 243 } 244 245 /* Copy back decrypted block */ 246 m_copyback(m, k, blks, blk); 247 248 /* Advance pointer */ 249 m = m_getptr(m, k + blks, &k); 250 if (m == NULL) 251 return EINVAL; 252 253 i -= blks; 254 255 /* Could be done... */ 256 if (i == 0) 257 break; 258 } 259 260 /* Skip possibly empty mbufs */ 261 if (k == m->m_len) { 262 for (m = m->m_next; m && m->m_len == 0; 263 m = m->m_next) 264 ; 265 k = 0; 266 } 267 268 /* Sanity check */ 269 if (m == NULL) 270 return EINVAL; 271 272 /* 273 * Warning: idat may point to garbage here, but 274 * we only use it in the while() loop, only if 275 * there are indeed enough data. 276 */ 277 idat = mtod(m, unsigned char *) + k; 278 279 while (m->m_len >= k + blks && i > 0) { 280 if (crd->crd_flags & CRD_F_ENCRYPT) { 281 /* XOR with previous block/IV */ 282 for (j = 0; j < blks; j++) 283 idat[j] ^= ivp[j]; 284 285 exf->encrypt(sw->sw_kschedule, idat); 286 ivp = idat; 287 } else { /* decrypt */ 288 /* 289 * Keep encrypted block to be used 290 * in next block's processing. 291 */ 292 if (ivp == iv) 293 bcopy(idat, piv, blks); 294 else 295 bcopy(idat, iv, blks); 296 297 exf->decrypt(sw->sw_kschedule, idat); 298 299 /* XOR with previous block/IV */ 300 for (j = 0; j < blks; j++) 301 idat[j] ^= ivp[j]; 302 303 if (ivp == iv) 304 bcopy(piv, iv, blks); 305 else 306 ivp = iv; 307 } 308 309 idat += blks; 310 k += blks; 311 i -= blks; 312 } 313 } 314 315 return 0; /* Done with mbuf encryption/decryption */ 316 } else if (outtype == CRYPTO_BUF_IOV) { 317 struct uio *uio = (struct uio *) buf; 318 struct iovec *iov; 319 320 /* Find beginning of data */ 321 iov = cuio_getptr(uio, crd->crd_skip, &k); 322 if (iov == NULL) 323 return EINVAL; 324 325 i = crd->crd_len; 326 327 while (i > 0) { 328 /* 329 * If there's insufficient data at the end of 330 * an iovec, we have to do some copying. 331 */ 332 if (iov->iov_len < k + blks && iov->iov_len != k) { 333 cuio_copydata(uio, k, blks, blk); 334 335 /* Actual encryption/decryption */ 336 if (crd->crd_flags & CRD_F_ENCRYPT) { 337 /* XOR with previous block */ 338 for (j = 0; j < blks; j++) 339 blk[j] ^= ivp[j]; 340 341 exf->encrypt(sw->sw_kschedule, blk); 342 343 /* 344 * Keep encrypted block for XOR'ing 345 * with next block 346 */ 347 bcopy(blk, iv, blks); 348 ivp = iv; 349 } else { /* decrypt */ 350 /* 351 * Keep encrypted block for XOR'ing 352 * with next block 353 */ 354 if (ivp == iv) 355 bcopy(blk, piv, blks); 356 else 357 bcopy(blk, iv, blks); 358 359 exf->decrypt(sw->sw_kschedule, blk); 360 361 /* XOR with previous block */ 362 for (j = 0; j < blks; j++) 363 blk[j] ^= ivp[j]; 364 365 if (ivp == iv) 366 bcopy(piv, iv, blks); 367 else 368 ivp = iv; 369 } 370 371 /* Copy back decrypted block */ 372 cuio_copyback(uio, k, blks, blk); 373 374 /* Advance pointer */ 375 iov = cuio_getptr(uio, k + blks, &k); 376 if (iov == NULL) 377 return EINVAL; 378 379 i -= blks; 380 381 /* Could be done... */ 382 if (i == 0) 383 break; 384 } 385 386 /* 387 * Warning: idat may point to garbage here, but 388 * we only use it in the while() loop, only if 389 * there are indeed enough data. 390 */ 391 idat = (char *)iov->iov_base + k; 392 393 while (iov->iov_len >= k + blks && i > 0) { 394 if (crd->crd_flags & CRD_F_ENCRYPT) { 395 /* XOR with previous block/IV */ 396 for (j = 0; j < blks; j++) 397 idat[j] ^= ivp[j]; 398 399 exf->encrypt(sw->sw_kschedule, idat); 400 ivp = idat; 401 } else { /* decrypt */ 402 /* 403 * Keep encrypted block to be used 404 * in next block's processing. 405 */ 406 if (ivp == iv) 407 bcopy(idat, piv, blks); 408 else 409 bcopy(idat, iv, blks); 410 411 exf->decrypt(sw->sw_kschedule, idat); 412 413 /* XOR with previous block/IV */ 414 for (j = 0; j < blks; j++) 415 idat[j] ^= ivp[j]; 416 417 if (ivp == iv) 418 bcopy(piv, iv, blks); 419 else 420 ivp = iv; 421 } 422 423 idat += blks; 424 k += blks; 425 i -= blks; 426 } 427 } 428 429 return 0; /* Done with mbuf encryption/decryption */ 430 } 431 432 /* Unreachable */ 433 return EINVAL; 434 } 435 436 /* 437 * Compute keyed-hash authenticator. 438 */ 439 static int 440 swcr_authcompute(struct cryptop *crp, struct cryptodesc *crd, 441 struct swcr_data *sw, caddr_t buf, int outtype) 442 { 443 unsigned char aalg[AALG_MAX_RESULT_LEN]; 444 struct auth_hash *axf; 445 union authctx ctx; 446 int err; 447 448 if (sw->sw_ictx == 0) 449 return EINVAL; 450 451 axf = sw->sw_axf; 452 453 bcopy(sw->sw_ictx, &ctx, axf->ctxsize); 454 455 switch (outtype) { 456 case CRYPTO_BUF_CONTIG: 457 axf->Update(&ctx, buf + crd->crd_skip, crd->crd_len); 458 break; 459 case CRYPTO_BUF_MBUF: 460 err = m_apply((struct mbuf *) buf, crd->crd_skip, crd->crd_len, 461 (int (*)(caddr_t, caddr_t, unsigned int)) axf->Update, 462 (caddr_t) &ctx); 463 if (err) 464 return err; 465 break; 466 case CRYPTO_BUF_IOV: 467 default: 468 return EINVAL; 469 } 470 471 switch (sw->sw_alg) { 472 case CRYPTO_MD5_HMAC: 473 case CRYPTO_SHA1_HMAC: 474 case CRYPTO_SHA2_HMAC: 475 case CRYPTO_RIPEMD160_HMAC: 476 if (sw->sw_octx == NULL) 477 return EINVAL; 478 479 axf->Final(aalg, &ctx); 480 bcopy(sw->sw_octx, &ctx, axf->ctxsize); 481 axf->Update(&ctx, aalg, axf->hashsize); 482 axf->Final(aalg, &ctx); 483 break; 484 485 case CRYPTO_MD5_KPDK: 486 case CRYPTO_SHA1_KPDK: 487 if (sw->sw_octx == NULL) 488 return EINVAL; 489 490 axf->Update(&ctx, sw->sw_octx, sw->sw_klen); 491 axf->Final(aalg, &ctx); 492 break; 493 494 case CRYPTO_NULL_HMAC: 495 axf->Final(aalg, &ctx); 496 break; 497 } 498 499 /* Inject the authentication data */ 500 if (outtype == CRYPTO_BUF_CONTIG) 501 bcopy(aalg, buf + crd->crd_inject, axf->authsize); 502 else 503 m_copyback((struct mbuf *) buf, crd->crd_inject, 504 axf->authsize, aalg); 505 return 0; 506 } 507 508 /* 509 * Apply a compression/decompression algorithm 510 */ 511 static int 512 swcr_compdec(struct cryptodesc *crd, struct swcr_data *sw, 513 caddr_t buf, int outtype) 514 { 515 u_int8_t *data, *out; 516 struct comp_algo *cxf; 517 int adj; 518 u_int32_t result; 519 520 cxf = sw->sw_cxf; 521 522 /* We must handle the whole buffer of data in one time 523 * then if there is not all the data in the mbuf, we must 524 * copy in a buffer. 525 */ 526 527 MALLOC(data, u_int8_t *, crd->crd_len, M_CRYPTO_DATA, M_NOWAIT); 528 if (data == NULL) 529 return (EINVAL); 530 COPYDATA(outtype, buf, crd->crd_skip, crd->crd_len, data); 531 532 if (crd->crd_flags & CRD_F_COMP) 533 result = cxf->compress(data, crd->crd_len, &out); 534 else 535 result = cxf->decompress(data, crd->crd_len, &out); 536 537 FREE(data, M_CRYPTO_DATA); 538 if (result == 0) 539 return EINVAL; 540 541 /* Copy back the (de)compressed data. m_copyback is 542 * extending the mbuf as necessary. 543 */ 544 sw->sw_size = result; 545 /* Check the compressed size when doing compression */ 546 if (crd->crd_flags & CRD_F_COMP) { 547 if (result > crd->crd_len) { 548 /* Compression was useless, we lost time */ 549 FREE(out, M_CRYPTO_DATA); 550 return 0; 551 } 552 } 553 554 COPYBACK(outtype, buf, crd->crd_skip, result, out); 555 if (result < crd->crd_len) { 556 adj = result - crd->crd_len; 557 if (outtype == CRYPTO_BUF_MBUF) { 558 adj = result - crd->crd_len; 559 m_adj((struct mbuf *)buf, adj); 560 } else { 561 struct uio *uio = (struct uio *)buf; 562 int ind; 563 564 adj = crd->crd_len - result; 565 ind = uio->uio_iovcnt - 1; 566 567 while (adj > 0 && ind >= 0) { 568 if (adj < uio->uio_iov[ind].iov_len) { 569 uio->uio_iov[ind].iov_len -= adj; 570 break; 571 } 572 573 adj -= uio->uio_iov[ind].iov_len; 574 uio->uio_iov[ind].iov_len = 0; 575 ind--; 576 uio->uio_iovcnt--; 577 } 578 } 579 } 580 FREE(out, M_CRYPTO_DATA); 581 return 0; 582 } 583 584 /* 585 * Generate a new software session. 586 */ 587 static int 588 swcr_newsession(void *arg, u_int32_t *sid, struct cryptoini *cri) 589 { 590 struct swcr_data **swd; 591 struct auth_hash *axf; 592 struct enc_xform *txf; 593 struct comp_algo *cxf; 594 u_int32_t i; 595 int k, error; 596 597 if (sid == NULL || cri == NULL) 598 return EINVAL; 599 600 if (swcr_sessions) { 601 for (i = 1; i < swcr_sesnum; i++) 602 if (swcr_sessions[i] == NULL) 603 break; 604 } else 605 i = 1; /* NB: to silence compiler warning */ 606 607 if (swcr_sessions == NULL || i == swcr_sesnum) { 608 if (swcr_sessions == NULL) { 609 i = 1; /* We leave swcr_sessions[0] empty */ 610 swcr_sesnum = CRYPTO_SW_SESSIONS; 611 } else 612 swcr_sesnum *= 2; 613 614 swd = malloc(swcr_sesnum * sizeof(struct swcr_data *), 615 M_CRYPTO_DATA, M_NOWAIT|M_ZERO); 616 if (swd == NULL) { 617 /* Reset session number */ 618 if (swcr_sesnum == CRYPTO_SW_SESSIONS) 619 swcr_sesnum = 0; 620 else 621 swcr_sesnum /= 2; 622 return ENOBUFS; 623 } 624 625 /* Copy existing sessions */ 626 if (swcr_sessions) { 627 bcopy(swcr_sessions, swd, 628 (swcr_sesnum / 2) * sizeof(struct swcr_data *)); 629 free(swcr_sessions, M_CRYPTO_DATA); 630 } 631 632 swcr_sessions = swd; 633 } 634 635 swd = &swcr_sessions[i]; 636 *sid = i; 637 638 while (cri) { 639 MALLOC(*swd, struct swcr_data *, sizeof(struct swcr_data), 640 M_CRYPTO_DATA, M_NOWAIT|M_ZERO); 641 if (*swd == NULL) { 642 swcr_freesession(NULL, i); 643 return ENOBUFS; 644 } 645 646 switch (cri->cri_alg) { 647 case CRYPTO_DES_CBC: 648 txf = &enc_xform_des; 649 goto enccommon; 650 case CRYPTO_3DES_CBC: 651 txf = &enc_xform_3des; 652 goto enccommon; 653 case CRYPTO_BLF_CBC: 654 txf = &enc_xform_blf; 655 goto enccommon; 656 case CRYPTO_CAST_CBC: 657 txf = &enc_xform_cast5; 658 goto enccommon; 659 case CRYPTO_SKIPJACK_CBC: 660 txf = &enc_xform_skipjack; 661 goto enccommon; 662 case CRYPTO_RIJNDAEL128_CBC: 663 txf = &enc_xform_rijndael128; 664 goto enccommon; 665 case CRYPTO_NULL_CBC: 666 txf = &enc_xform_null; 667 goto enccommon; 668 enccommon: 669 error = txf->setkey(&((*swd)->sw_kschedule), 670 cri->cri_key, cri->cri_klen / 8); 671 if (error) { 672 swcr_freesession(NULL, i); 673 return error; 674 } 675 (*swd)->sw_exf = txf; 676 break; 677 678 case CRYPTO_MD5_HMAC: 679 axf = &auth_hash_hmac_md5_96; 680 goto authcommon; 681 case CRYPTO_SHA1_HMAC: 682 axf = &auth_hash_hmac_sha1_96; 683 goto authcommon; 684 case CRYPTO_SHA2_HMAC: 685 if (cri->cri_klen == 256) 686 axf = &auth_hash_hmac_sha2_256; 687 else if (cri->cri_klen == 384) 688 axf = &auth_hash_hmac_sha2_384; 689 else if (cri->cri_klen == 512) 690 axf = &auth_hash_hmac_sha2_512; 691 else { 692 swcr_freesession(NULL, i); 693 return EINVAL; 694 } 695 goto authcommon; 696 case CRYPTO_NULL_HMAC: 697 axf = &auth_hash_null; 698 goto authcommon; 699 case CRYPTO_RIPEMD160_HMAC: 700 axf = &auth_hash_hmac_ripemd_160_96; 701 authcommon: 702 (*swd)->sw_ictx = malloc(axf->ctxsize, M_CRYPTO_DATA, 703 M_NOWAIT); 704 if ((*swd)->sw_ictx == NULL) { 705 swcr_freesession(NULL, i); 706 return ENOBUFS; 707 } 708 709 (*swd)->sw_octx = malloc(axf->ctxsize, M_CRYPTO_DATA, 710 M_NOWAIT); 711 if ((*swd)->sw_octx == NULL) { 712 swcr_freesession(NULL, i); 713 return ENOBUFS; 714 } 715 716 for (k = 0; k < cri->cri_klen / 8; k++) 717 cri->cri_key[k] ^= HMAC_IPAD_VAL; 718 719 axf->Init((*swd)->sw_ictx); 720 axf->Update((*swd)->sw_ictx, cri->cri_key, 721 cri->cri_klen / 8); 722 axf->Update((*swd)->sw_ictx, hmac_ipad_buffer, 723 HMAC_BLOCK_LEN - (cri->cri_klen / 8)); 724 725 for (k = 0; k < cri->cri_klen / 8; k++) 726 cri->cri_key[k] ^= (HMAC_IPAD_VAL ^ HMAC_OPAD_VAL); 727 728 axf->Init((*swd)->sw_octx); 729 axf->Update((*swd)->sw_octx, cri->cri_key, 730 cri->cri_klen / 8); 731 axf->Update((*swd)->sw_octx, hmac_opad_buffer, 732 HMAC_BLOCK_LEN - (cri->cri_klen / 8)); 733 734 for (k = 0; k < cri->cri_klen / 8; k++) 735 cri->cri_key[k] ^= HMAC_OPAD_VAL; 736 (*swd)->sw_axf = axf; 737 break; 738 739 case CRYPTO_MD5_KPDK: 740 axf = &auth_hash_key_md5; 741 goto auth2common; 742 743 case CRYPTO_SHA1_KPDK: 744 axf = &auth_hash_key_sha1; 745 auth2common: 746 (*swd)->sw_ictx = malloc(axf->ctxsize, M_CRYPTO_DATA, 747 M_NOWAIT); 748 if ((*swd)->sw_ictx == NULL) { 749 swcr_freesession(NULL, i); 750 return ENOBUFS; 751 } 752 753 /* Store the key so we can "append" it to the payload */ 754 (*swd)->sw_octx = malloc(cri->cri_klen / 8, M_CRYPTO_DATA, 755 M_NOWAIT); 756 if ((*swd)->sw_octx == NULL) { 757 swcr_freesession(NULL, i); 758 return ENOBUFS; 759 } 760 761 (*swd)->sw_klen = cri->cri_klen / 8; 762 bcopy(cri->cri_key, (*swd)->sw_octx, cri->cri_klen / 8); 763 axf->Init((*swd)->sw_ictx); 764 axf->Update((*swd)->sw_ictx, cri->cri_key, 765 cri->cri_klen / 8); 766 axf->Final(NULL, (*swd)->sw_ictx); 767 (*swd)->sw_axf = axf; 768 break; 769 #ifdef notdef 770 case CRYPTO_MD5: 771 axf = &auth_hash_md5; 772 goto auth3common; 773 774 case CRYPTO_SHA1: 775 axf = &auth_hash_sha1; 776 auth3common: 777 (*swd)->sw_ictx = malloc(axf->ctxsize, M_CRYPTO_DATA, 778 M_NOWAIT); 779 if ((*swd)->sw_ictx == NULL) { 780 swcr_freesession(NULL, i); 781 return ENOBUFS; 782 } 783 784 axf->Init((*swd)->sw_ictx); 785 (*swd)->sw_axf = axf; 786 break; 787 #endif 788 case CRYPTO_DEFLATE_COMP: 789 cxf = &comp_algo_deflate; 790 (*swd)->sw_cxf = cxf; 791 break; 792 default: 793 swcr_freesession(NULL, i); 794 return EINVAL; 795 } 796 797 (*swd)->sw_alg = cri->cri_alg; 798 cri = cri->cri_next; 799 swd = &((*swd)->sw_next); 800 } 801 return 0; 802 } 803 804 /* 805 * Free a session. 806 */ 807 static int 808 swcr_freesession(void *arg, u_int64_t tid) 809 { 810 struct swcr_data *swd; 811 struct enc_xform *txf; 812 struct auth_hash *axf; 813 struct comp_algo *cxf; 814 u_int32_t sid = ((u_int32_t) tid) & 0xffffffff; 815 816 if (sid > swcr_sesnum || swcr_sessions == NULL || 817 swcr_sessions[sid] == NULL) 818 return EINVAL; 819 820 /* Silently accept and return */ 821 if (sid == 0) 822 return 0; 823 824 while ((swd = swcr_sessions[sid]) != NULL) { 825 swcr_sessions[sid] = swd->sw_next; 826 827 switch (swd->sw_alg) { 828 case CRYPTO_DES_CBC: 829 case CRYPTO_3DES_CBC: 830 case CRYPTO_BLF_CBC: 831 case CRYPTO_CAST_CBC: 832 case CRYPTO_SKIPJACK_CBC: 833 case CRYPTO_RIJNDAEL128_CBC: 834 case CRYPTO_NULL_CBC: 835 txf = swd->sw_exf; 836 837 if (swd->sw_kschedule) 838 txf->zerokey(&(swd->sw_kschedule)); 839 break; 840 841 case CRYPTO_MD5_HMAC: 842 case CRYPTO_SHA1_HMAC: 843 case CRYPTO_SHA2_HMAC: 844 case CRYPTO_RIPEMD160_HMAC: 845 case CRYPTO_NULL_HMAC: 846 axf = swd->sw_axf; 847 848 if (swd->sw_ictx) { 849 bzero(swd->sw_ictx, axf->ctxsize); 850 free(swd->sw_ictx, M_CRYPTO_DATA); 851 } 852 if (swd->sw_octx) { 853 bzero(swd->sw_octx, axf->ctxsize); 854 free(swd->sw_octx, M_CRYPTO_DATA); 855 } 856 break; 857 858 case CRYPTO_MD5_KPDK: 859 case CRYPTO_SHA1_KPDK: 860 axf = swd->sw_axf; 861 862 if (swd->sw_ictx) { 863 bzero(swd->sw_ictx, axf->ctxsize); 864 free(swd->sw_ictx, M_CRYPTO_DATA); 865 } 866 if (swd->sw_octx) { 867 bzero(swd->sw_octx, swd->sw_klen); 868 free(swd->sw_octx, M_CRYPTO_DATA); 869 } 870 break; 871 872 case CRYPTO_MD5: 873 case CRYPTO_SHA1: 874 axf = swd->sw_axf; 875 876 if (swd->sw_ictx) 877 free(swd->sw_ictx, M_CRYPTO_DATA); 878 break; 879 880 case CRYPTO_DEFLATE_COMP: 881 cxf = swd->sw_cxf; 882 break; 883 } 884 885 FREE(swd, M_CRYPTO_DATA); 886 } 887 return 0; 888 } 889 890 /* 891 * Process a software request. 892 */ 893 static int 894 swcr_process(void *arg, struct cryptop *crp, int hint) 895 { 896 struct cryptodesc *crd; 897 struct swcr_data *sw; 898 u_int32_t lid; 899 int type; 900 901 /* Sanity check */ 902 if (crp == NULL) 903 return EINVAL; 904 905 if (crp->crp_desc == NULL || crp->crp_buf == NULL) { 906 crp->crp_etype = EINVAL; 907 goto done; 908 } 909 910 lid = crp->crp_sid & 0xffffffff; 911 if (lid >= swcr_sesnum || lid == 0 || swcr_sessions[lid] == NULL) { 912 crp->crp_etype = ENOENT; 913 goto done; 914 } 915 916 if (crp->crp_flags & CRYPTO_F_IMBUF) { 917 type = CRYPTO_BUF_MBUF; 918 } else if (crp->crp_flags & CRYPTO_F_IOV) { 919 type = CRYPTO_BUF_IOV; 920 } else { 921 type = CRYPTO_BUF_CONTIG; 922 } 923 924 /* Go through crypto descriptors, processing as we go */ 925 for (crd = crp->crp_desc; crd; crd = crd->crd_next) { 926 /* 927 * Find the crypto context. 928 * 929 * XXX Note that the logic here prevents us from having 930 * XXX the same algorithm multiple times in a session 931 * XXX (or rather, we can but it won't give us the right 932 * XXX results). To do that, we'd need some way of differentiating 933 * XXX between the various instances of an algorithm (so we can 934 * XXX locate the correct crypto context). 935 */ 936 for (sw = swcr_sessions[lid]; 937 sw && sw->sw_alg != crd->crd_alg; 938 sw = sw->sw_next) 939 ; 940 941 /* No such context ? */ 942 if (sw == NULL) { 943 crp->crp_etype = EINVAL; 944 goto done; 945 } 946 switch (sw->sw_alg) { 947 case CRYPTO_DES_CBC: 948 case CRYPTO_3DES_CBC: 949 case CRYPTO_BLF_CBC: 950 case CRYPTO_CAST_CBC: 951 case CRYPTO_SKIPJACK_CBC: 952 case CRYPTO_RIJNDAEL128_CBC: 953 if ((crp->crp_etype = swcr_encdec(crd, sw, 954 crp->crp_buf, type)) != 0) 955 goto done; 956 break; 957 case CRYPTO_NULL_CBC: 958 crp->crp_etype = 0; 959 break; 960 case CRYPTO_MD5_HMAC: 961 case CRYPTO_SHA1_HMAC: 962 case CRYPTO_SHA2_HMAC: 963 case CRYPTO_RIPEMD160_HMAC: 964 case CRYPTO_NULL_HMAC: 965 case CRYPTO_MD5_KPDK: 966 case CRYPTO_SHA1_KPDK: 967 case CRYPTO_MD5: 968 case CRYPTO_SHA1: 969 if ((crp->crp_etype = swcr_authcompute(crp, crd, sw, 970 crp->crp_buf, type)) != 0) 971 goto done; 972 break; 973 974 case CRYPTO_DEFLATE_COMP: 975 if ((crp->crp_etype = swcr_compdec(crd, sw, 976 crp->crp_buf, type)) != 0) 977 goto done; 978 else 979 crp->crp_olen = (int)sw->sw_size; 980 break; 981 982 default: 983 /* Unknown/unsupported algorithm */ 984 crp->crp_etype = EINVAL; 985 goto done; 986 } 987 } 988 989 done: 990 crypto_done(crp); 991 return 0; 992 } 993 994 /* 995 * Initialize the driver, called from the kernel main(). 996 */ 997 static void 998 swcr_init(void) 999 { 1000 swcr_id = crypto_get_driverid(CRYPTOCAP_F_SOFTWARE); 1001 if (swcr_id < 0) 1002 panic("Software crypto device cannot initialize!"); 1003 crypto_register(swcr_id, CRYPTO_DES_CBC, 1004 0, 0, swcr_newsession, swcr_freesession, swcr_process, NULL); 1005 #define REGISTER(alg) \ 1006 crypto_register(swcr_id, alg, 0,0,NULL,NULL,NULL,NULL) 1007 REGISTER(CRYPTO_3DES_CBC); 1008 REGISTER(CRYPTO_BLF_CBC); 1009 REGISTER(CRYPTO_CAST_CBC); 1010 REGISTER(CRYPTO_SKIPJACK_CBC); 1011 REGISTER(CRYPTO_NULL_CBC); 1012 REGISTER(CRYPTO_MD5_HMAC); 1013 REGISTER(CRYPTO_SHA1_HMAC); 1014 REGISTER(CRYPTO_SHA2_HMAC); 1015 REGISTER(CRYPTO_RIPEMD160_HMAC); 1016 REGISTER(CRYPTO_NULL_HMAC); 1017 REGISTER(CRYPTO_MD5_KPDK); 1018 REGISTER(CRYPTO_SHA1_KPDK); 1019 REGISTER(CRYPTO_MD5); 1020 REGISTER(CRYPTO_SHA1); 1021 REGISTER(CRYPTO_RIJNDAEL128_CBC); 1022 REGISTER(CRYPTO_DEFLATE_COMP); 1023 #undef REGISTER 1024 } 1025 SYSINIT(cryptosoft_init, SI_SUB_PSEUDO, SI_ORDER_ANY, swcr_init, NULL) 1026