2 * Crypto user configuration API.
4 * Copyright (C) 2011 secunet Security Networks AG
5 * Copyright (C) 2011 Steffen Klassert <steffen.klassert@secunet.com>
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms and conditions of the GNU General Public License,
9 * version 2, as published by the Free Software Foundation.
11 * This program is distributed in the hope it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
16 * You should have received a copy of the GNU General Public License along with
17 * this program; if not, write to the Free Software Foundation, Inc.,
18 * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
21 #include <linux/module.h>
22 #include <linux/crypto.h>
23 #include <linux/cryptouser.h>
24 #include <linux/sched.h>
25 #include <net/netlink.h>
26 #include <linux/security.h>
27 #include <net/net_namespace.h>
28 #include <crypto/internal/skcipher.h>
29 #include <crypto/internal/rng.h>
30 #include <crypto/akcipher.h>
31 #include <crypto/kpp.h>
35 #define null_terminated(x) (strnlen(x, sizeof(x)) < sizeof(x))
37 static DEFINE_MUTEX(crypto_cfg_mutex
);
39 /* The crypto netlink socket */
40 static struct sock
*crypto_nlsk
;
42 struct crypto_dump_info
{
43 struct sk_buff
*in_skb
;
44 struct sk_buff
*out_skb
;
49 static struct crypto_alg
*crypto_alg_match(struct crypto_user_alg
*p
, int exact
)
51 struct crypto_alg
*q
, *alg
= NULL
;
53 down_read(&crypto_alg_sem
);
55 list_for_each_entry(q
, &crypto_alg_list
, cra_list
) {
58 if (crypto_is_larval(q
))
61 if ((q
->cra_flags
^ p
->cru_type
) & p
->cru_mask
)
64 if (strlen(p
->cru_driver_name
))
65 match
= !strcmp(q
->cra_driver_name
,
68 match
= !strcmp(q
->cra_name
, p
->cru_name
);
73 if (unlikely(!crypto_mod_get(q
)))
80 up_read(&crypto_alg_sem
);
85 static int crypto_report_cipher(struct sk_buff
*skb
, struct crypto_alg
*alg
)
87 struct crypto_report_cipher rcipher
;
89 strncpy(rcipher
.type
, "cipher", sizeof(rcipher
.type
));
91 rcipher
.blocksize
= alg
->cra_blocksize
;
92 rcipher
.min_keysize
= alg
->cra_cipher
.cia_min_keysize
;
93 rcipher
.max_keysize
= alg
->cra_cipher
.cia_max_keysize
;
95 if (nla_put(skb
, CRYPTOCFGA_REPORT_CIPHER
,
96 sizeof(struct crypto_report_cipher
), &rcipher
))
104 static int crypto_report_comp(struct sk_buff
*skb
, struct crypto_alg
*alg
)
106 struct crypto_report_comp rcomp
;
108 strncpy(rcomp
.type
, "compression", sizeof(rcomp
.type
));
109 if (nla_put(skb
, CRYPTOCFGA_REPORT_COMPRESS
,
110 sizeof(struct crypto_report_comp
), &rcomp
))
111 goto nla_put_failure
;
118 static int crypto_report_acomp(struct sk_buff
*skb
, struct crypto_alg
*alg
)
120 struct crypto_report_acomp racomp
;
122 strncpy(racomp
.type
, "acomp", sizeof(racomp
.type
));
124 if (nla_put(skb
, CRYPTOCFGA_REPORT_ACOMP
,
125 sizeof(struct crypto_report_acomp
), &racomp
))
126 goto nla_put_failure
;
133 static int crypto_report_akcipher(struct sk_buff
*skb
, struct crypto_alg
*alg
)
135 struct crypto_report_akcipher rakcipher
;
137 strncpy(rakcipher
.type
, "akcipher", sizeof(rakcipher
.type
));
139 if (nla_put(skb
, CRYPTOCFGA_REPORT_AKCIPHER
,
140 sizeof(struct crypto_report_akcipher
), &rakcipher
))
141 goto nla_put_failure
;
148 static int crypto_report_kpp(struct sk_buff
*skb
, struct crypto_alg
*alg
)
150 struct crypto_report_kpp rkpp
;
152 strncpy(rkpp
.type
, "kpp", sizeof(rkpp
.type
));
154 if (nla_put(skb
, CRYPTOCFGA_REPORT_KPP
,
155 sizeof(struct crypto_report_kpp
), &rkpp
))
156 goto nla_put_failure
;
163 static int crypto_report_one(struct crypto_alg
*alg
,
164 struct crypto_user_alg
*ualg
, struct sk_buff
*skb
)
166 strncpy(ualg
->cru_name
, alg
->cra_name
, sizeof(ualg
->cru_name
));
167 strncpy(ualg
->cru_driver_name
, alg
->cra_driver_name
,
168 sizeof(ualg
->cru_driver_name
));
169 strncpy(ualg
->cru_module_name
, module_name(alg
->cra_module
),
170 sizeof(ualg
->cru_module_name
));
174 ualg
->cru_flags
= alg
->cra_flags
;
175 ualg
->cru_refcnt
= atomic_read(&alg
->cra_refcnt
);
177 if (nla_put_u32(skb
, CRYPTOCFGA_PRIORITY_VAL
, alg
->cra_priority
))
178 goto nla_put_failure
;
179 if (alg
->cra_flags
& CRYPTO_ALG_LARVAL
) {
180 struct crypto_report_larval rl
;
182 strncpy(rl
.type
, "larval", sizeof(rl
.type
));
183 if (nla_put(skb
, CRYPTOCFGA_REPORT_LARVAL
,
184 sizeof(struct crypto_report_larval
), &rl
))
185 goto nla_put_failure
;
189 if (alg
->cra_type
&& alg
->cra_type
->report
) {
190 if (alg
->cra_type
->report(skb
, alg
))
191 goto nla_put_failure
;
196 switch (alg
->cra_flags
& (CRYPTO_ALG_TYPE_MASK
| CRYPTO_ALG_LARVAL
)) {
197 case CRYPTO_ALG_TYPE_CIPHER
:
198 if (crypto_report_cipher(skb
, alg
))
199 goto nla_put_failure
;
202 case CRYPTO_ALG_TYPE_COMPRESS
:
203 if (crypto_report_comp(skb
, alg
))
204 goto nla_put_failure
;
207 case CRYPTO_ALG_TYPE_ACOMPRESS
:
208 if (crypto_report_acomp(skb
, alg
))
209 goto nla_put_failure
;
212 case CRYPTO_ALG_TYPE_AKCIPHER
:
213 if (crypto_report_akcipher(skb
, alg
))
214 goto nla_put_failure
;
217 case CRYPTO_ALG_TYPE_KPP
:
218 if (crypto_report_kpp(skb
, alg
))
219 goto nla_put_failure
;
230 static int crypto_report_alg(struct crypto_alg
*alg
,
231 struct crypto_dump_info
*info
)
233 struct sk_buff
*in_skb
= info
->in_skb
;
234 struct sk_buff
*skb
= info
->out_skb
;
235 struct nlmsghdr
*nlh
;
236 struct crypto_user_alg
*ualg
;
239 nlh
= nlmsg_put(skb
, NETLINK_CB(in_skb
).portid
, info
->nlmsg_seq
,
240 CRYPTO_MSG_GETALG
, sizeof(*ualg
), info
->nlmsg_flags
);
246 ualg
= nlmsg_data(nlh
);
248 err
= crypto_report_one(alg
, ualg
, skb
);
250 nlmsg_cancel(skb
, nlh
);
260 static int crypto_report(struct sk_buff
*in_skb
, struct nlmsghdr
*in_nlh
,
261 struct nlattr
**attrs
)
263 struct crypto_user_alg
*p
= nlmsg_data(in_nlh
);
264 struct crypto_alg
*alg
;
266 struct crypto_dump_info info
;
269 if (!null_terminated(p
->cru_name
) || !null_terminated(p
->cru_driver_name
))
272 alg
= crypto_alg_match(p
, 0);
277 skb
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_ATOMIC
);
281 info
.in_skb
= in_skb
;
283 info
.nlmsg_seq
= in_nlh
->nlmsg_seq
;
284 info
.nlmsg_flags
= 0;
286 err
= crypto_report_alg(alg
, &info
);
294 return nlmsg_unicast(crypto_nlsk
, skb
, NETLINK_CB(in_skb
).portid
);
297 static int crypto_dump_report(struct sk_buff
*skb
, struct netlink_callback
*cb
)
299 struct crypto_alg
*alg
;
300 struct crypto_dump_info info
;
308 info
.in_skb
= cb
->skb
;
310 info
.nlmsg_seq
= cb
->nlh
->nlmsg_seq
;
311 info
.nlmsg_flags
= NLM_F_MULTI
;
313 list_for_each_entry(alg
, &crypto_alg_list
, cra_list
) {
314 err
= crypto_report_alg(alg
, &info
);
325 static int crypto_dump_report_done(struct netlink_callback
*cb
)
330 static int crypto_update_alg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
331 struct nlattr
**attrs
)
333 struct crypto_alg
*alg
;
334 struct crypto_user_alg
*p
= nlmsg_data(nlh
);
335 struct nlattr
*priority
= attrs
[CRYPTOCFGA_PRIORITY_VAL
];
338 if (!netlink_capable(skb
, CAP_NET_ADMIN
))
341 if (!null_terminated(p
->cru_name
) || !null_terminated(p
->cru_driver_name
))
344 if (priority
&& !strlen(p
->cru_driver_name
))
347 alg
= crypto_alg_match(p
, 1);
351 down_write(&crypto_alg_sem
);
353 crypto_remove_spawns(alg
, &list
, NULL
);
356 alg
->cra_priority
= nla_get_u32(priority
);
358 up_write(&crypto_alg_sem
);
361 crypto_remove_final(&list
);
366 static int crypto_del_alg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
367 struct nlattr
**attrs
)
369 struct crypto_alg
*alg
;
370 struct crypto_user_alg
*p
= nlmsg_data(nlh
);
373 if (!netlink_capable(skb
, CAP_NET_ADMIN
))
376 if (!null_terminated(p
->cru_name
) || !null_terminated(p
->cru_driver_name
))
379 alg
= crypto_alg_match(p
, 1);
383 /* We can not unregister core algorithms such as aes-generic.
384 * We would loose the reference in the crypto_alg_list to this algorithm
385 * if we try to unregister. Unregistering such an algorithm without
386 * removing the module is not possible, so we restrict to crypto
387 * instances that are build from templates. */
389 if (!(alg
->cra_flags
& CRYPTO_ALG_INSTANCE
))
393 if (atomic_read(&alg
->cra_refcnt
) > 2)
396 err
= crypto_unregister_instance((struct crypto_instance
*)alg
);
403 static int crypto_add_alg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
404 struct nlattr
**attrs
)
408 struct crypto_alg
*alg
;
409 struct crypto_user_alg
*p
= nlmsg_data(nlh
);
410 struct nlattr
*priority
= attrs
[CRYPTOCFGA_PRIORITY_VAL
];
412 if (!netlink_capable(skb
, CAP_NET_ADMIN
))
415 if (!null_terminated(p
->cru_name
) || !null_terminated(p
->cru_driver_name
))
418 if (strlen(p
->cru_driver_name
))
421 if (priority
&& !exact
)
424 alg
= crypto_alg_match(p
, exact
);
430 if (strlen(p
->cru_driver_name
))
431 name
= p
->cru_driver_name
;
435 alg
= crypto_alg_mod_lookup(name
, p
->cru_type
, p
->cru_mask
);
439 down_write(&crypto_alg_sem
);
442 alg
->cra_priority
= nla_get_u32(priority
);
444 up_write(&crypto_alg_sem
);
451 static int crypto_del_rng(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
452 struct nlattr
**attrs
)
454 if (!netlink_capable(skb
, CAP_NET_ADMIN
))
456 return crypto_del_default_rng();
459 #define MSGSIZE(type) sizeof(struct type)
461 static const int crypto_msg_min
[CRYPTO_NR_MSGTYPES
] = {
462 [CRYPTO_MSG_NEWALG
- CRYPTO_MSG_BASE
] = MSGSIZE(crypto_user_alg
),
463 [CRYPTO_MSG_DELALG
- CRYPTO_MSG_BASE
] = MSGSIZE(crypto_user_alg
),
464 [CRYPTO_MSG_UPDATEALG
- CRYPTO_MSG_BASE
] = MSGSIZE(crypto_user_alg
),
465 [CRYPTO_MSG_GETALG
- CRYPTO_MSG_BASE
] = MSGSIZE(crypto_user_alg
),
466 [CRYPTO_MSG_DELRNG
- CRYPTO_MSG_BASE
] = 0,
469 static const struct nla_policy crypto_policy
[CRYPTOCFGA_MAX
+1] = {
470 [CRYPTOCFGA_PRIORITY_VAL
] = { .type
= NLA_U32
},
475 static const struct crypto_link
{
476 int (*doit
)(struct sk_buff
*, struct nlmsghdr
*, struct nlattr
**);
477 int (*dump
)(struct sk_buff
*, struct netlink_callback
*);
478 int (*done
)(struct netlink_callback
*);
479 } crypto_dispatch
[CRYPTO_NR_MSGTYPES
] = {
480 [CRYPTO_MSG_NEWALG
- CRYPTO_MSG_BASE
] = { .doit
= crypto_add_alg
},
481 [CRYPTO_MSG_DELALG
- CRYPTO_MSG_BASE
] = { .doit
= crypto_del_alg
},
482 [CRYPTO_MSG_UPDATEALG
- CRYPTO_MSG_BASE
] = { .doit
= crypto_update_alg
},
483 [CRYPTO_MSG_GETALG
- CRYPTO_MSG_BASE
] = { .doit
= crypto_report
,
484 .dump
= crypto_dump_report
,
485 .done
= crypto_dump_report_done
},
486 [CRYPTO_MSG_DELRNG
- CRYPTO_MSG_BASE
] = { .doit
= crypto_del_rng
},
489 static int crypto_user_rcv_msg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
490 struct netlink_ext_ack
*extack
)
492 struct nlattr
*attrs
[CRYPTOCFGA_MAX
+1];
493 const struct crypto_link
*link
;
496 type
= nlh
->nlmsg_type
;
497 if (type
> CRYPTO_MSG_MAX
)
500 type
-= CRYPTO_MSG_BASE
;
501 link
= &crypto_dispatch
[type
];
503 if ((type
== (CRYPTO_MSG_GETALG
- CRYPTO_MSG_BASE
) &&
504 (nlh
->nlmsg_flags
& NLM_F_DUMP
))) {
505 struct crypto_alg
*alg
;
508 if (link
->dump
== NULL
)
511 down_read(&crypto_alg_sem
);
512 list_for_each_entry(alg
, &crypto_alg_list
, cra_list
)
513 dump_alloc
+= CRYPTO_REPORT_MAXSIZE
;
516 struct netlink_dump_control c
= {
519 .min_dump_alloc
= dump_alloc
,
521 err
= netlink_dump_start(crypto_nlsk
, skb
, nlh
, &c
);
523 up_read(&crypto_alg_sem
);
528 err
= nlmsg_parse(nlh
, crypto_msg_min
[type
], attrs
, CRYPTOCFGA_MAX
,
529 crypto_policy
, extack
);
533 if (link
->doit
== NULL
)
536 return link
->doit(skb
, nlh
, attrs
);
539 static void crypto_netlink_rcv(struct sk_buff
*skb
)
541 mutex_lock(&crypto_cfg_mutex
);
542 netlink_rcv_skb(skb
, &crypto_user_rcv_msg
);
543 mutex_unlock(&crypto_cfg_mutex
);
546 static int __init
crypto_user_init(void)
548 struct netlink_kernel_cfg cfg
= {
549 .input
= crypto_netlink_rcv
,
552 crypto_nlsk
= netlink_kernel_create(&init_net
, NETLINK_CRYPTO
, &cfg
);
559 static void __exit
crypto_user_exit(void)
561 netlink_kernel_release(crypto_nlsk
);
564 module_init(crypto_user_init
);
565 module_exit(crypto_user_exit
);
566 MODULE_LICENSE("GPL");
567 MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
568 MODULE_DESCRIPTION("Crypto userspace configuration API");
569 MODULE_ALIAS("net-pf-16-proto-21");