1 /* 2 * Crypto user configuration API. 3 * 4 * Copyright (C) 2011 secunet Security Networks AG 5 * Copyright (C) 2011 Steffen Klassert <steffen.klassert@secunet.com> 6 * 7 * This program is free software; you can redistribute it and/or modify it 8 * under the terms and conditions of the GNU General Public License, 9 * version 2, as published by the Free Software Foundation. 10 * 11 * This program is distributed in the hope it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 14 * more details. 15 * 16 * You should have received a copy of the GNU General Public License along with 17 * this program; if not, write to the Free Software Foundation, Inc., 18 * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA. 19 */ 20 21 #include <linux/module.h> 22 #include <linux/crypto.h> 23 #include <linux/cryptouser.h> 24 #include <linux/sched.h> 25 #include <net/netlink.h> 26 #include <linux/security.h> 27 #include <net/net_namespace.h> 28 #include <crypto/internal/skcipher.h> 29 #include <crypto/internal/rng.h> 30 #include <crypto/akcipher.h> 31 #include <crypto/kpp.h> 32 #include <crypto/internal/cryptouser.h> 33 34 #include "internal.h" 35 36 #define null_terminated(x) (strnlen(x, sizeof(x)) < sizeof(x)) 37 38 static DEFINE_MUTEX(crypto_cfg_mutex); 39 40 /* The crypto netlink socket */ 41 struct sock *crypto_nlsk; 42 43 struct crypto_dump_info { 44 struct sk_buff *in_skb; 45 struct sk_buff *out_skb; 46 u32 nlmsg_seq; 47 u16 nlmsg_flags; 48 }; 49 50 struct crypto_alg *crypto_alg_match(struct crypto_user_alg *p, int exact) 51 { 52 struct crypto_alg *q, *alg = NULL; 53 54 down_read(&crypto_alg_sem); 55 56 list_for_each_entry(q, &crypto_alg_list, cra_list) { 57 int match = 0; 58 59 if ((q->cra_flags ^ p->cru_type) & p->cru_mask) 60 continue; 61 62 if (strlen(p->cru_driver_name)) 63 match = !strcmp(q->cra_driver_name, 64 p->cru_driver_name); 65 else if (!exact) 66 match = !strcmp(q->cra_name, p->cru_name); 67 68 if (!match) 69 continue; 70 71 if (unlikely(!crypto_mod_get(q))) 72 continue; 73 74 alg = q; 75 break; 76 } 77 78 up_read(&crypto_alg_sem); 79 80 return alg; 81 } 82 83 static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg) 84 { 85 struct crypto_report_cipher rcipher; 86 87 strncpy(rcipher.type, "cipher", sizeof(rcipher.type)); 88 89 rcipher.blocksize = alg->cra_blocksize; 90 rcipher.min_keysize = alg->cra_cipher.cia_min_keysize; 91 rcipher.max_keysize = alg->cra_cipher.cia_max_keysize; 92 93 if (nla_put(skb, CRYPTOCFGA_REPORT_CIPHER, 94 sizeof(struct crypto_report_cipher), &rcipher)) 95 goto nla_put_failure; 96 return 0; 97 98 nla_put_failure: 99 return -EMSGSIZE; 100 } 101 102 static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg) 103 { 104 struct crypto_report_comp rcomp; 105 106 strncpy(rcomp.type, "compression", sizeof(rcomp.type)); 107 if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS, 108 sizeof(struct crypto_report_comp), &rcomp)) 109 goto nla_put_failure; 110 return 0; 111 112 nla_put_failure: 113 return -EMSGSIZE; 114 } 115 116 static int crypto_report_acomp(struct sk_buff *skb, struct crypto_alg *alg) 117 { 118 struct crypto_report_acomp racomp; 119 120 strncpy(racomp.type, "acomp", sizeof(racomp.type)); 121 122 if (nla_put(skb, CRYPTOCFGA_REPORT_ACOMP, 123 sizeof(struct crypto_report_acomp), &racomp)) 124 goto nla_put_failure; 125 return 0; 126 127 nla_put_failure: 128 return -EMSGSIZE; 129 } 130 131 static int crypto_report_akcipher(struct sk_buff *skb, struct crypto_alg *alg) 132 { 133 struct crypto_report_akcipher rakcipher; 134 135 strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type)); 136 137 if (nla_put(skb, CRYPTOCFGA_REPORT_AKCIPHER, 138 sizeof(struct crypto_report_akcipher), &rakcipher)) 139 goto nla_put_failure; 140 return 0; 141 142 nla_put_failure: 143 return -EMSGSIZE; 144 } 145 146 static int crypto_report_kpp(struct sk_buff *skb, struct crypto_alg *alg) 147 { 148 struct crypto_report_kpp rkpp; 149 150 strncpy(rkpp.type, "kpp", sizeof(rkpp.type)); 151 152 if (nla_put(skb, CRYPTOCFGA_REPORT_KPP, 153 sizeof(struct crypto_report_kpp), &rkpp)) 154 goto nla_put_failure; 155 return 0; 156 157 nla_put_failure: 158 return -EMSGSIZE; 159 } 160 161 static int crypto_report_one(struct crypto_alg *alg, 162 struct crypto_user_alg *ualg, struct sk_buff *skb) 163 { 164 strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name)); 165 strncpy(ualg->cru_driver_name, alg->cra_driver_name, 166 sizeof(ualg->cru_driver_name)); 167 strncpy(ualg->cru_module_name, module_name(alg->cra_module), 168 sizeof(ualg->cru_module_name)); 169 170 ualg->cru_type = 0; 171 ualg->cru_mask = 0; 172 ualg->cru_flags = alg->cra_flags; 173 ualg->cru_refcnt = refcount_read(&alg->cra_refcnt); 174 175 if (nla_put_u32(skb, CRYPTOCFGA_PRIORITY_VAL, alg->cra_priority)) 176 goto nla_put_failure; 177 if (alg->cra_flags & CRYPTO_ALG_LARVAL) { 178 struct crypto_report_larval rl; 179 180 strncpy(rl.type, "larval", sizeof(rl.type)); 181 if (nla_put(skb, CRYPTOCFGA_REPORT_LARVAL, 182 sizeof(struct crypto_report_larval), &rl)) 183 goto nla_put_failure; 184 goto out; 185 } 186 187 if (alg->cra_type && alg->cra_type->report) { 188 if (alg->cra_type->report(skb, alg)) 189 goto nla_put_failure; 190 191 goto out; 192 } 193 194 switch (alg->cra_flags & (CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_LARVAL)) { 195 case CRYPTO_ALG_TYPE_CIPHER: 196 if (crypto_report_cipher(skb, alg)) 197 goto nla_put_failure; 198 199 break; 200 case CRYPTO_ALG_TYPE_COMPRESS: 201 if (crypto_report_comp(skb, alg)) 202 goto nla_put_failure; 203 204 break; 205 case CRYPTO_ALG_TYPE_ACOMPRESS: 206 if (crypto_report_acomp(skb, alg)) 207 goto nla_put_failure; 208 209 break; 210 case CRYPTO_ALG_TYPE_AKCIPHER: 211 if (crypto_report_akcipher(skb, alg)) 212 goto nla_put_failure; 213 214 break; 215 case CRYPTO_ALG_TYPE_KPP: 216 if (crypto_report_kpp(skb, alg)) 217 goto nla_put_failure; 218 break; 219 } 220 221 out: 222 return 0; 223 224 nla_put_failure: 225 return -EMSGSIZE; 226 } 227 228 static int crypto_report_alg(struct crypto_alg *alg, 229 struct crypto_dump_info *info) 230 { 231 struct sk_buff *in_skb = info->in_skb; 232 struct sk_buff *skb = info->out_skb; 233 struct nlmsghdr *nlh; 234 struct crypto_user_alg *ualg; 235 int err = 0; 236 237 nlh = nlmsg_put(skb, NETLINK_CB(in_skb).portid, info->nlmsg_seq, 238 CRYPTO_MSG_GETALG, sizeof(*ualg), info->nlmsg_flags); 239 if (!nlh) { 240 err = -EMSGSIZE; 241 goto out; 242 } 243 244 ualg = nlmsg_data(nlh); 245 246 err = crypto_report_one(alg, ualg, skb); 247 if (err) { 248 nlmsg_cancel(skb, nlh); 249 goto out; 250 } 251 252 nlmsg_end(skb, nlh); 253 254 out: 255 return err; 256 } 257 258 static int crypto_report(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, 259 struct nlattr **attrs) 260 { 261 struct crypto_user_alg *p = nlmsg_data(in_nlh); 262 struct crypto_alg *alg; 263 struct sk_buff *skb; 264 struct crypto_dump_info info; 265 int err; 266 267 if (!null_terminated(p->cru_name) || !null_terminated(p->cru_driver_name)) 268 return -EINVAL; 269 270 alg = crypto_alg_match(p, 0); 271 if (!alg) 272 return -ENOENT; 273 274 err = -ENOMEM; 275 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 276 if (!skb) 277 goto drop_alg; 278 279 info.in_skb = in_skb; 280 info.out_skb = skb; 281 info.nlmsg_seq = in_nlh->nlmsg_seq; 282 info.nlmsg_flags = 0; 283 284 err = crypto_report_alg(alg, &info); 285 286 drop_alg: 287 crypto_mod_put(alg); 288 289 if (err) 290 return err; 291 292 return nlmsg_unicast(crypto_nlsk, skb, NETLINK_CB(in_skb).portid); 293 } 294 295 static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb) 296 { 297 struct crypto_alg *alg; 298 struct crypto_dump_info info; 299 int err; 300 301 if (cb->args[0]) 302 goto out; 303 304 cb->args[0] = 1; 305 306 info.in_skb = cb->skb; 307 info.out_skb = skb; 308 info.nlmsg_seq = cb->nlh->nlmsg_seq; 309 info.nlmsg_flags = NLM_F_MULTI; 310 311 list_for_each_entry(alg, &crypto_alg_list, cra_list) { 312 err = crypto_report_alg(alg, &info); 313 if (err) 314 goto out_err; 315 } 316 317 out: 318 return skb->len; 319 out_err: 320 return err; 321 } 322 323 static int crypto_dump_report_done(struct netlink_callback *cb) 324 { 325 return 0; 326 } 327 328 static int crypto_update_alg(struct sk_buff *skb, struct nlmsghdr *nlh, 329 struct nlattr **attrs) 330 { 331 struct crypto_alg *alg; 332 struct crypto_user_alg *p = nlmsg_data(nlh); 333 struct nlattr *priority = attrs[CRYPTOCFGA_PRIORITY_VAL]; 334 LIST_HEAD(list); 335 336 if (!netlink_capable(skb, CAP_NET_ADMIN)) 337 return -EPERM; 338 339 if (!null_terminated(p->cru_name) || !null_terminated(p->cru_driver_name)) 340 return -EINVAL; 341 342 if (priority && !strlen(p->cru_driver_name)) 343 return -EINVAL; 344 345 alg = crypto_alg_match(p, 1); 346 if (!alg) 347 return -ENOENT; 348 349 down_write(&crypto_alg_sem); 350 351 crypto_remove_spawns(alg, &list, NULL); 352 353 if (priority) 354 alg->cra_priority = nla_get_u32(priority); 355 356 up_write(&crypto_alg_sem); 357 358 crypto_mod_put(alg); 359 crypto_remove_final(&list); 360 361 return 0; 362 } 363 364 static int crypto_del_alg(struct sk_buff *skb, struct nlmsghdr *nlh, 365 struct nlattr **attrs) 366 { 367 struct crypto_alg *alg; 368 struct crypto_user_alg *p = nlmsg_data(nlh); 369 int err; 370 371 if (!netlink_capable(skb, CAP_NET_ADMIN)) 372 return -EPERM; 373 374 if (!null_terminated(p->cru_name) || !null_terminated(p->cru_driver_name)) 375 return -EINVAL; 376 377 alg = crypto_alg_match(p, 1); 378 if (!alg) 379 return -ENOENT; 380 381 /* We can not unregister core algorithms such as aes-generic. 382 * We would loose the reference in the crypto_alg_list to this algorithm 383 * if we try to unregister. Unregistering such an algorithm without 384 * removing the module is not possible, so we restrict to crypto 385 * instances that are build from templates. */ 386 err = -EINVAL; 387 if (!(alg->cra_flags & CRYPTO_ALG_INSTANCE)) 388 goto drop_alg; 389 390 err = -EBUSY; 391 if (refcount_read(&alg->cra_refcnt) > 2) 392 goto drop_alg; 393 394 err = crypto_unregister_instance((struct crypto_instance *)alg); 395 396 drop_alg: 397 crypto_mod_put(alg); 398 return err; 399 } 400 401 static int crypto_add_alg(struct sk_buff *skb, struct nlmsghdr *nlh, 402 struct nlattr **attrs) 403 { 404 int exact = 0; 405 const char *name; 406 struct crypto_alg *alg; 407 struct crypto_user_alg *p = nlmsg_data(nlh); 408 struct nlattr *priority = attrs[CRYPTOCFGA_PRIORITY_VAL]; 409 410 if (!netlink_capable(skb, CAP_NET_ADMIN)) 411 return -EPERM; 412 413 if (!null_terminated(p->cru_name) || !null_terminated(p->cru_driver_name)) 414 return -EINVAL; 415 416 if (strlen(p->cru_driver_name)) 417 exact = 1; 418 419 if (priority && !exact) 420 return -EINVAL; 421 422 alg = crypto_alg_match(p, exact); 423 if (alg) { 424 crypto_mod_put(alg); 425 return -EEXIST; 426 } 427 428 if (strlen(p->cru_driver_name)) 429 name = p->cru_driver_name; 430 else 431 name = p->cru_name; 432 433 alg = crypto_alg_mod_lookup(name, p->cru_type, p->cru_mask); 434 if (IS_ERR(alg)) 435 return PTR_ERR(alg); 436 437 down_write(&crypto_alg_sem); 438 439 if (priority) 440 alg->cra_priority = nla_get_u32(priority); 441 442 up_write(&crypto_alg_sem); 443 444 crypto_mod_put(alg); 445 446 return 0; 447 } 448 449 static int crypto_del_rng(struct sk_buff *skb, struct nlmsghdr *nlh, 450 struct nlattr **attrs) 451 { 452 if (!netlink_capable(skb, CAP_NET_ADMIN)) 453 return -EPERM; 454 return crypto_del_default_rng(); 455 } 456 457 #define MSGSIZE(type) sizeof(struct type) 458 459 static const int crypto_msg_min[CRYPTO_NR_MSGTYPES] = { 460 [CRYPTO_MSG_NEWALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), 461 [CRYPTO_MSG_DELALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), 462 [CRYPTO_MSG_UPDATEALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), 463 [CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), 464 [CRYPTO_MSG_DELRNG - CRYPTO_MSG_BASE] = 0, 465 [CRYPTO_MSG_GETSTAT - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg), 466 }; 467 468 static const struct nla_policy crypto_policy[CRYPTOCFGA_MAX+1] = { 469 [CRYPTOCFGA_PRIORITY_VAL] = { .type = NLA_U32}, 470 }; 471 472 #undef MSGSIZE 473 474 static const struct crypto_link { 475 int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **); 476 int (*dump)(struct sk_buff *, struct netlink_callback *); 477 int (*done)(struct netlink_callback *); 478 } crypto_dispatch[CRYPTO_NR_MSGTYPES] = { 479 [CRYPTO_MSG_NEWALG - CRYPTO_MSG_BASE] = { .doit = crypto_add_alg}, 480 [CRYPTO_MSG_DELALG - CRYPTO_MSG_BASE] = { .doit = crypto_del_alg}, 481 [CRYPTO_MSG_UPDATEALG - CRYPTO_MSG_BASE] = { .doit = crypto_update_alg}, 482 [CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE] = { .doit = crypto_report, 483 .dump = crypto_dump_report, 484 .done = crypto_dump_report_done}, 485 [CRYPTO_MSG_DELRNG - CRYPTO_MSG_BASE] = { .doit = crypto_del_rng }, 486 [CRYPTO_MSG_GETSTAT - CRYPTO_MSG_BASE] = { .doit = crypto_reportstat, 487 .dump = crypto_dump_reportstat, 488 .done = crypto_dump_reportstat_done}, 489 }; 490 491 static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, 492 struct netlink_ext_ack *extack) 493 { 494 struct nlattr *attrs[CRYPTOCFGA_MAX+1]; 495 const struct crypto_link *link; 496 int type, err; 497 498 type = nlh->nlmsg_type; 499 if (type > CRYPTO_MSG_MAX) 500 return -EINVAL; 501 502 type -= CRYPTO_MSG_BASE; 503 link = &crypto_dispatch[type]; 504 505 if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) && 506 (nlh->nlmsg_flags & NLM_F_DUMP))) { 507 struct crypto_alg *alg; 508 u16 dump_alloc = 0; 509 510 if (link->dump == NULL) 511 return -EINVAL; 512 513 down_read(&crypto_alg_sem); 514 list_for_each_entry(alg, &crypto_alg_list, cra_list) 515 dump_alloc += CRYPTO_REPORT_MAXSIZE; 516 517 { 518 struct netlink_dump_control c = { 519 .dump = link->dump, 520 .done = link->done, 521 .min_dump_alloc = dump_alloc, 522 }; 523 err = netlink_dump_start(crypto_nlsk, skb, nlh, &c); 524 } 525 up_read(&crypto_alg_sem); 526 527 return err; 528 } 529 530 err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX, 531 crypto_policy, extack); 532 if (err < 0) 533 return err; 534 535 if (link->doit == NULL) 536 return -EINVAL; 537 538 return link->doit(skb, nlh, attrs); 539 } 540 541 static void crypto_netlink_rcv(struct sk_buff *skb) 542 { 543 mutex_lock(&crypto_cfg_mutex); 544 netlink_rcv_skb(skb, &crypto_user_rcv_msg); 545 mutex_unlock(&crypto_cfg_mutex); 546 } 547 548 static int __init crypto_user_init(void) 549 { 550 struct netlink_kernel_cfg cfg = { 551 .input = crypto_netlink_rcv, 552 }; 553 554 crypto_nlsk = netlink_kernel_create(&init_net, NETLINK_CRYPTO, &cfg); 555 if (!crypto_nlsk) 556 return -ENOMEM; 557 558 return 0; 559 } 560 561 static void __exit crypto_user_exit(void) 562 { 563 netlink_kernel_release(crypto_nlsk); 564 } 565 566 module_init(crypto_user_init); 567 module_exit(crypto_user_exit); 568 MODULE_LICENSE("GPL"); 569 MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>"); 570 MODULE_DESCRIPTION("Crypto userspace configuration API"); 571 MODULE_ALIAS("net-pf-16-proto-21"); 572