1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * authencesn.c - AEAD wrapper for IPsec with extended sequence numbers,
4 * derived from authenc.c
6 * Copyright (C) 2010 secunet Security Networks AG
7 * Copyright (C) 2010 Steffen Klassert <steffen.klassert@secunet.com>
8 * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
11 #include <crypto/internal/aead.h>
12 #include <crypto/internal/hash.h>
13 #include <crypto/internal/skcipher.h>
14 #include <crypto/authenc.h>
15 #include <crypto/null.h>
16 #include <crypto/scatterwalk.h>
17 #include <linux/err.h>
18 #include <linux/init.h>
19 #include <linux/kernel.h>
20 #include <linux/module.h>
21 #include <linux/rtnetlink.h>
22 #include <linux/slab.h>
23 #include <linux/spinlock.h>
25 struct authenc_esn_instance_ctx
{
26 struct crypto_ahash_spawn auth
;
27 struct crypto_skcipher_spawn enc
;
30 struct crypto_authenc_esn_ctx
{
32 struct crypto_ahash
*auth
;
33 struct crypto_skcipher
*enc
;
34 struct crypto_sync_skcipher
*null
;
37 struct authenc_esn_request_ctx
{
38 struct scatterlist src
[2];
39 struct scatterlist dst
[2];
43 static void authenc_esn_request_complete(struct aead_request
*req
, int err
)
45 if (err
!= -EINPROGRESS
)
46 aead_request_complete(req
, err
);
49 static int crypto_authenc_esn_setauthsize(struct crypto_aead
*authenc_esn
,
50 unsigned int authsize
)
52 if (authsize
> 0 && authsize
< 4)
58 static int crypto_authenc_esn_setkey(struct crypto_aead
*authenc_esn
, const u8
*key
,
61 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
62 struct crypto_ahash
*auth
= ctx
->auth
;
63 struct crypto_skcipher
*enc
= ctx
->enc
;
64 struct crypto_authenc_keys keys
;
67 if (crypto_authenc_extractkeys(&keys
, key
, keylen
) != 0)
70 crypto_ahash_clear_flags(auth
, CRYPTO_TFM_REQ_MASK
);
71 crypto_ahash_set_flags(auth
, crypto_aead_get_flags(authenc_esn
) &
73 err
= crypto_ahash_setkey(auth
, keys
.authkey
, keys
.authkeylen
);
74 crypto_aead_set_flags(authenc_esn
, crypto_ahash_get_flags(auth
) &
80 crypto_skcipher_clear_flags(enc
, CRYPTO_TFM_REQ_MASK
);
81 crypto_skcipher_set_flags(enc
, crypto_aead_get_flags(authenc_esn
) &
83 err
= crypto_skcipher_setkey(enc
, keys
.enckey
, keys
.enckeylen
);
84 crypto_aead_set_flags(authenc_esn
, crypto_skcipher_get_flags(enc
) &
88 memzero_explicit(&keys
, sizeof(keys
));
92 static int crypto_authenc_esn_genicv_tail(struct aead_request
*req
,
95 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
96 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
97 struct authenc_esn_request_ctx
*areq_ctx
= aead_request_ctx(req
);
98 struct crypto_ahash
*auth
= ctx
->auth
;
99 u8
*hash
= PTR_ALIGN((u8
*)areq_ctx
->tail
,
100 crypto_ahash_alignmask(auth
) + 1);
101 unsigned int authsize
= crypto_aead_authsize(authenc_esn
);
102 unsigned int assoclen
= req
->assoclen
;
103 unsigned int cryptlen
= req
->cryptlen
;
104 struct scatterlist
*dst
= req
->dst
;
107 /* Move high-order bits of sequence number back. */
108 scatterwalk_map_and_copy(tmp
, dst
, 4, 4, 0);
109 scatterwalk_map_and_copy(tmp
+ 1, dst
, assoclen
+ cryptlen
, 4, 0);
110 scatterwalk_map_and_copy(tmp
, dst
, 0, 8, 1);
112 scatterwalk_map_and_copy(hash
, dst
, assoclen
+ cryptlen
, authsize
, 1);
116 static void authenc_esn_geniv_ahash_done(struct crypto_async_request
*areq
,
119 struct aead_request
*req
= areq
->data
;
121 err
= err
?: crypto_authenc_esn_genicv_tail(req
, 0);
122 aead_request_complete(req
, err
);
125 static int crypto_authenc_esn_genicv(struct aead_request
*req
,
128 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
129 struct authenc_esn_request_ctx
*areq_ctx
= aead_request_ctx(req
);
130 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
131 struct crypto_ahash
*auth
= ctx
->auth
;
132 u8
*hash
= PTR_ALIGN((u8
*)areq_ctx
->tail
,
133 crypto_ahash_alignmask(auth
) + 1);
134 struct ahash_request
*ahreq
= (void *)(areq_ctx
->tail
+ ctx
->reqoff
);
135 unsigned int authsize
= crypto_aead_authsize(authenc_esn
);
136 unsigned int assoclen
= req
->assoclen
;
137 unsigned int cryptlen
= req
->cryptlen
;
138 struct scatterlist
*dst
= req
->dst
;
144 /* Move high-order bits of sequence number to the end. */
145 scatterwalk_map_and_copy(tmp
, dst
, 0, 8, 0);
146 scatterwalk_map_and_copy(tmp
, dst
, 4, 4, 1);
147 scatterwalk_map_and_copy(tmp
+ 1, dst
, assoclen
+ cryptlen
, 4, 1);
149 sg_init_table(areq_ctx
->dst
, 2);
150 dst
= scatterwalk_ffwd(areq_ctx
->dst
, dst
, 4);
152 ahash_request_set_tfm(ahreq
, auth
);
153 ahash_request_set_crypt(ahreq
, dst
, hash
, assoclen
+ cryptlen
);
154 ahash_request_set_callback(ahreq
, flags
,
155 authenc_esn_geniv_ahash_done
, req
);
157 return crypto_ahash_digest(ahreq
) ?:
158 crypto_authenc_esn_genicv_tail(req
, aead_request_flags(req
));
162 static void crypto_authenc_esn_encrypt_done(struct crypto_async_request
*req
,
165 struct aead_request
*areq
= req
->data
;
168 err
= crypto_authenc_esn_genicv(areq
, 0);
170 authenc_esn_request_complete(areq
, err
);
173 static int crypto_authenc_esn_copy(struct aead_request
*req
, unsigned int len
)
175 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
176 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
177 SYNC_SKCIPHER_REQUEST_ON_STACK(skreq
, ctx
->null
);
179 skcipher_request_set_sync_tfm(skreq
, ctx
->null
);
180 skcipher_request_set_callback(skreq
, aead_request_flags(req
),
182 skcipher_request_set_crypt(skreq
, req
->src
, req
->dst
, len
, NULL
);
184 return crypto_skcipher_encrypt(skreq
);
187 static int crypto_authenc_esn_encrypt(struct aead_request
*req
)
189 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
190 struct authenc_esn_request_ctx
*areq_ctx
= aead_request_ctx(req
);
191 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
192 struct skcipher_request
*skreq
= (void *)(areq_ctx
->tail
+
194 struct crypto_skcipher
*enc
= ctx
->enc
;
195 unsigned int assoclen
= req
->assoclen
;
196 unsigned int cryptlen
= req
->cryptlen
;
197 struct scatterlist
*src
, *dst
;
200 sg_init_table(areq_ctx
->src
, 2);
201 src
= scatterwalk_ffwd(areq_ctx
->src
, req
->src
, assoclen
);
204 if (req
->src
!= req
->dst
) {
205 err
= crypto_authenc_esn_copy(req
, assoclen
);
209 sg_init_table(areq_ctx
->dst
, 2);
210 dst
= scatterwalk_ffwd(areq_ctx
->dst
, req
->dst
, assoclen
);
213 skcipher_request_set_tfm(skreq
, enc
);
214 skcipher_request_set_callback(skreq
, aead_request_flags(req
),
215 crypto_authenc_esn_encrypt_done
, req
);
216 skcipher_request_set_crypt(skreq
, src
, dst
, cryptlen
, req
->iv
);
218 err
= crypto_skcipher_encrypt(skreq
);
222 return crypto_authenc_esn_genicv(req
, aead_request_flags(req
));
225 static int crypto_authenc_esn_decrypt_tail(struct aead_request
*req
,
228 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
229 unsigned int authsize
= crypto_aead_authsize(authenc_esn
);
230 struct authenc_esn_request_ctx
*areq_ctx
= aead_request_ctx(req
);
231 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
232 struct skcipher_request
*skreq
= (void *)(areq_ctx
->tail
+
234 struct crypto_ahash
*auth
= ctx
->auth
;
235 u8
*ohash
= PTR_ALIGN((u8
*)areq_ctx
->tail
,
236 crypto_ahash_alignmask(auth
) + 1);
237 unsigned int cryptlen
= req
->cryptlen
- authsize
;
238 unsigned int assoclen
= req
->assoclen
;
239 struct scatterlist
*dst
= req
->dst
;
240 u8
*ihash
= ohash
+ crypto_ahash_digestsize(auth
);
246 /* Move high-order bits of sequence number back. */
247 scatterwalk_map_and_copy(tmp
, dst
, 4, 4, 0);
248 scatterwalk_map_and_copy(tmp
+ 1, dst
, assoclen
+ cryptlen
, 4, 0);
249 scatterwalk_map_and_copy(tmp
, dst
, 0, 8, 1);
251 if (crypto_memneq(ihash
, ohash
, authsize
))
256 sg_init_table(areq_ctx
->dst
, 2);
257 dst
= scatterwalk_ffwd(areq_ctx
->dst
, dst
, assoclen
);
259 skcipher_request_set_tfm(skreq
, ctx
->enc
);
260 skcipher_request_set_callback(skreq
, flags
,
261 req
->base
.complete
, req
->base
.data
);
262 skcipher_request_set_crypt(skreq
, dst
, dst
, cryptlen
, req
->iv
);
264 return crypto_skcipher_decrypt(skreq
);
267 static void authenc_esn_verify_ahash_done(struct crypto_async_request
*areq
,
270 struct aead_request
*req
= areq
->data
;
272 err
= err
?: crypto_authenc_esn_decrypt_tail(req
, 0);
273 authenc_esn_request_complete(req
, err
);
276 static int crypto_authenc_esn_decrypt(struct aead_request
*req
)
278 struct crypto_aead
*authenc_esn
= crypto_aead_reqtfm(req
);
279 struct authenc_esn_request_ctx
*areq_ctx
= aead_request_ctx(req
);
280 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(authenc_esn
);
281 struct ahash_request
*ahreq
= (void *)(areq_ctx
->tail
+ ctx
->reqoff
);
282 unsigned int authsize
= crypto_aead_authsize(authenc_esn
);
283 struct crypto_ahash
*auth
= ctx
->auth
;
284 u8
*ohash
= PTR_ALIGN((u8
*)areq_ctx
->tail
,
285 crypto_ahash_alignmask(auth
) + 1);
286 unsigned int assoclen
= req
->assoclen
;
287 unsigned int cryptlen
= req
->cryptlen
;
288 u8
*ihash
= ohash
+ crypto_ahash_digestsize(auth
);
289 struct scatterlist
*dst
= req
->dst
;
293 cryptlen
-= authsize
;
295 if (req
->src
!= dst
) {
296 err
= crypto_authenc_esn_copy(req
, assoclen
+ cryptlen
);
301 scatterwalk_map_and_copy(ihash
, req
->src
, assoclen
+ cryptlen
,
307 /* Move high-order bits of sequence number to the end. */
308 scatterwalk_map_and_copy(tmp
, dst
, 0, 8, 0);
309 scatterwalk_map_and_copy(tmp
, dst
, 4, 4, 1);
310 scatterwalk_map_and_copy(tmp
+ 1, dst
, assoclen
+ cryptlen
, 4, 1);
312 sg_init_table(areq_ctx
->dst
, 2);
313 dst
= scatterwalk_ffwd(areq_ctx
->dst
, dst
, 4);
315 ahash_request_set_tfm(ahreq
, auth
);
316 ahash_request_set_crypt(ahreq
, dst
, ohash
, assoclen
+ cryptlen
);
317 ahash_request_set_callback(ahreq
, aead_request_flags(req
),
318 authenc_esn_verify_ahash_done
, req
);
320 err
= crypto_ahash_digest(ahreq
);
325 return crypto_authenc_esn_decrypt_tail(req
, aead_request_flags(req
));
328 static int crypto_authenc_esn_init_tfm(struct crypto_aead
*tfm
)
330 struct aead_instance
*inst
= aead_alg_instance(tfm
);
331 struct authenc_esn_instance_ctx
*ictx
= aead_instance_ctx(inst
);
332 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(tfm
);
333 struct crypto_ahash
*auth
;
334 struct crypto_skcipher
*enc
;
335 struct crypto_sync_skcipher
*null
;
338 auth
= crypto_spawn_ahash(&ictx
->auth
);
340 return PTR_ERR(auth
);
342 enc
= crypto_spawn_skcipher(&ictx
->enc
);
347 null
= crypto_get_default_null_skcipher();
350 goto err_free_skcipher
;
356 ctx
->reqoff
= ALIGN(2 * crypto_ahash_digestsize(auth
),
357 crypto_ahash_alignmask(auth
) + 1);
359 crypto_aead_set_reqsize(
361 sizeof(struct authenc_esn_request_ctx
) +
364 crypto_ahash_reqsize(auth
) +
365 sizeof(struct ahash_request
),
366 sizeof(struct skcipher_request
) +
367 crypto_skcipher_reqsize(enc
)));
372 crypto_free_skcipher(enc
);
374 crypto_free_ahash(auth
);
378 static void crypto_authenc_esn_exit_tfm(struct crypto_aead
*tfm
)
380 struct crypto_authenc_esn_ctx
*ctx
= crypto_aead_ctx(tfm
);
382 crypto_free_ahash(ctx
->auth
);
383 crypto_free_skcipher(ctx
->enc
);
384 crypto_put_default_null_skcipher();
387 static void crypto_authenc_esn_free(struct aead_instance
*inst
)
389 struct authenc_esn_instance_ctx
*ctx
= aead_instance_ctx(inst
);
391 crypto_drop_skcipher(&ctx
->enc
);
392 crypto_drop_ahash(&ctx
->auth
);
396 static int crypto_authenc_esn_create(struct crypto_template
*tmpl
,
399 struct crypto_attr_type
*algt
;
400 struct aead_instance
*inst
;
401 struct hash_alg_common
*auth
;
402 struct crypto_alg
*auth_base
;
403 struct skcipher_alg
*enc
;
404 struct authenc_esn_instance_ctx
*ctx
;
405 const char *enc_name
;
408 algt
= crypto_get_attr_type(tb
);
410 return PTR_ERR(algt
);
412 if ((algt
->type
^ CRYPTO_ALG_TYPE_AEAD
) & algt
->mask
)
415 auth
= ahash_attr_alg(tb
[1], CRYPTO_ALG_TYPE_HASH
,
416 CRYPTO_ALG_TYPE_AHASH_MASK
|
417 crypto_requires_sync(algt
->type
, algt
->mask
));
419 return PTR_ERR(auth
);
421 auth_base
= &auth
->base
;
423 enc_name
= crypto_attr_alg_name(tb
[2]);
424 err
= PTR_ERR(enc_name
);
425 if (IS_ERR(enc_name
))
428 inst
= kzalloc(sizeof(*inst
) + sizeof(*ctx
), GFP_KERNEL
);
433 ctx
= aead_instance_ctx(inst
);
435 err
= crypto_init_ahash_spawn(&ctx
->auth
, auth
,
436 aead_crypto_instance(inst
));
440 crypto_set_skcipher_spawn(&ctx
->enc
, aead_crypto_instance(inst
));
441 err
= crypto_grab_skcipher(&ctx
->enc
, enc_name
, 0,
442 crypto_requires_sync(algt
->type
,
447 enc
= crypto_spawn_skcipher_alg(&ctx
->enc
);
450 if (snprintf(inst
->alg
.base
.cra_name
, CRYPTO_MAX_ALG_NAME
,
451 "authencesn(%s,%s)", auth_base
->cra_name
,
452 enc
->base
.cra_name
) >= CRYPTO_MAX_ALG_NAME
)
455 if (snprintf(inst
->alg
.base
.cra_driver_name
, CRYPTO_MAX_ALG_NAME
,
456 "authencesn(%s,%s)", auth_base
->cra_driver_name
,
457 enc
->base
.cra_driver_name
) >= CRYPTO_MAX_ALG_NAME
)
460 inst
->alg
.base
.cra_flags
= (auth_base
->cra_flags
|
461 enc
->base
.cra_flags
) & CRYPTO_ALG_ASYNC
;
462 inst
->alg
.base
.cra_priority
= enc
->base
.cra_priority
* 10 +
463 auth_base
->cra_priority
;
464 inst
->alg
.base
.cra_blocksize
= enc
->base
.cra_blocksize
;
465 inst
->alg
.base
.cra_alignmask
= auth_base
->cra_alignmask
|
466 enc
->base
.cra_alignmask
;
467 inst
->alg
.base
.cra_ctxsize
= sizeof(struct crypto_authenc_esn_ctx
);
469 inst
->alg
.ivsize
= crypto_skcipher_alg_ivsize(enc
);
470 inst
->alg
.chunksize
= crypto_skcipher_alg_chunksize(enc
);
471 inst
->alg
.maxauthsize
= auth
->digestsize
;
473 inst
->alg
.init
= crypto_authenc_esn_init_tfm
;
474 inst
->alg
.exit
= crypto_authenc_esn_exit_tfm
;
476 inst
->alg
.setkey
= crypto_authenc_esn_setkey
;
477 inst
->alg
.setauthsize
= crypto_authenc_esn_setauthsize
;
478 inst
->alg
.encrypt
= crypto_authenc_esn_encrypt
;
479 inst
->alg
.decrypt
= crypto_authenc_esn_decrypt
;
481 inst
->free
= crypto_authenc_esn_free
,
483 err
= aead_register_instance(tmpl
, inst
);
488 crypto_mod_put(auth_base
);
492 crypto_drop_skcipher(&ctx
->enc
);
494 crypto_drop_ahash(&ctx
->auth
);
501 static struct crypto_template crypto_authenc_esn_tmpl
= {
502 .name
= "authencesn",
503 .create
= crypto_authenc_esn_create
,
504 .module
= THIS_MODULE
,
507 static int __init
crypto_authenc_esn_module_init(void)
509 return crypto_register_template(&crypto_authenc_esn_tmpl
);
512 static void __exit
crypto_authenc_esn_module_exit(void)
514 crypto_unregister_template(&crypto_authenc_esn_tmpl
);
517 subsys_initcall(crypto_authenc_esn_module_init
);
518 module_exit(crypto_authenc_esn_module_exit
);
520 MODULE_LICENSE("GPL");
521 MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
522 MODULE_DESCRIPTION("AEAD wrapper for IPsec with extended sequence numbers");
523 MODULE_ALIAS_CRYPTO("authencesn");