1 /* 2 * Copyright (C)2006 USAGI/WIDE Project 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation; either version 2 of the License, or 7 * (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, write to the Free Software 16 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 17 * 18 * Author: 19 * Kazunori Miyazawa <miyazawa@linux-ipv6.org> 20 */ 21 22 #include <crypto/scatterwalk.h> 23 #include <linux/crypto.h> 24 #include <linux/err.h> 25 #include <linux/hardirq.h> 26 #include <linux/kernel.h> 27 #include <linux/mm.h> 28 #include <linux/rtnetlink.h> 29 #include <linux/slab.h> 30 #include <linux/scatterlist.h> 31 32 static u_int32_t ks[12] = {0x01010101, 0x01010101, 0x01010101, 0x01010101, 33 0x02020202, 0x02020202, 0x02020202, 0x02020202, 34 0x03030303, 0x03030303, 0x03030303, 0x03030303}; 35 /* 36 * +------------------------ 37 * | <parent tfm> 38 * +------------------------ 39 * | crypto_xcbc_ctx 40 * +------------------------ 41 * | odds (block size) 42 * +------------------------ 43 * | prev (block size) 44 * +------------------------ 45 * | key (block size) 46 * +------------------------ 47 * | consts (block size * 3) 48 * +------------------------ 49 */ 50 struct crypto_xcbc_ctx { 51 struct crypto_cipher *child; 52 u8 *odds; 53 u8 *prev; 54 u8 *key; 55 u8 *consts; 56 void (*xor)(u8 *a, const u8 *b, unsigned int bs); 57 unsigned int keylen; 58 unsigned int len; 59 }; 60 61 static void xor_128(u8 *a, const u8 *b, unsigned int bs) 62 { 63 ((u32 *)a)[0] ^= ((u32 *)b)[0]; 64 ((u32 *)a)[1] ^= ((u32 *)b)[1]; 65 ((u32 *)a)[2] ^= ((u32 *)b)[2]; 66 ((u32 *)a)[3] ^= ((u32 *)b)[3]; 67 } 68 69 static int _crypto_xcbc_digest_setkey(struct crypto_hash *parent, 70 struct crypto_xcbc_ctx *ctx) 71 { 72 int bs = crypto_hash_blocksize(parent); 73 int err = 0; 74 u8 key1[bs]; 75 76 if ((err = crypto_cipher_setkey(ctx->child, ctx->key, ctx->keylen))) 77 return err; 78 79 crypto_cipher_encrypt_one(ctx->child, key1, ctx->consts); 80 81 return crypto_cipher_setkey(ctx->child, key1, bs); 82 } 83 84 static int crypto_xcbc_digest_setkey(struct crypto_hash *parent, 85 const u8 *inkey, unsigned int keylen) 86 { 87 struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(parent); 88 89 if (keylen != crypto_cipher_blocksize(ctx->child)) 90 return -EINVAL; 91 92 ctx->keylen = keylen; 93 memcpy(ctx->key, inkey, keylen); 94 ctx->consts = (u8*)ks; 95 96 return _crypto_xcbc_digest_setkey(parent, ctx); 97 } 98 99 static int crypto_xcbc_digest_init(struct hash_desc *pdesc) 100 { 101 struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(pdesc->tfm); 102 int bs = crypto_hash_blocksize(pdesc->tfm); 103 104 ctx->len = 0; 105 memset(ctx->odds, 0, bs); 106 memset(ctx->prev, 0, bs); 107 108 return 0; 109 } 110 111 static int crypto_xcbc_digest_update2(struct hash_desc *pdesc, 112 struct scatterlist *sg, 113 unsigned int nbytes) 114 { 115 struct crypto_hash *parent = pdesc->tfm; 116 struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(parent); 117 struct crypto_cipher *tfm = ctx->child; 118 int bs = crypto_hash_blocksize(parent); 119 unsigned int i = 0; 120 121 do { 122 123 struct page *pg = sg_page(&sg[i]); 124 unsigned int offset = sg[i].offset; 125 unsigned int slen = sg[i].length; 126 127 if (unlikely(slen > nbytes)) 128 slen = nbytes; 129 130 nbytes -= slen; 131 132 while (slen > 0) { 133 unsigned int len = min(slen, ((unsigned int)(PAGE_SIZE)) - offset); 134 char *p = crypto_kmap(pg, 0) + offset; 135 136 /* checking the data can fill the block */ 137 if ((ctx->len + len) <= bs) { 138 memcpy(ctx->odds + ctx->len, p, len); 139 ctx->len += len; 140 slen -= len; 141 142 /* checking the rest of the page */ 143 if (len + offset >= PAGE_SIZE) { 144 offset = 0; 145 pg++; 146 } else 147 offset += len; 148 149 crypto_kunmap(p, 0); 150 crypto_yield(pdesc->flags); 151 continue; 152 } 153 154 /* filling odds with new data and encrypting it */ 155 memcpy(ctx->odds + ctx->len, p, bs - ctx->len); 156 len -= bs - ctx->len; 157 p += bs - ctx->len; 158 159 ctx->xor(ctx->prev, ctx->odds, bs); 160 crypto_cipher_encrypt_one(tfm, ctx->prev, ctx->prev); 161 162 /* clearing the length */ 163 ctx->len = 0; 164 165 /* encrypting the rest of data */ 166 while (len > bs) { 167 ctx->xor(ctx->prev, p, bs); 168 crypto_cipher_encrypt_one(tfm, ctx->prev, 169 ctx->prev); 170 p += bs; 171 len -= bs; 172 } 173 174 /* keeping the surplus of blocksize */ 175 if (len) { 176 memcpy(ctx->odds, p, len); 177 ctx->len = len; 178 } 179 crypto_kunmap(p, 0); 180 crypto_yield(pdesc->flags); 181 slen -= min(slen, ((unsigned int)(PAGE_SIZE)) - offset); 182 offset = 0; 183 pg++; 184 } 185 i++; 186 } while (nbytes>0); 187 188 return 0; 189 } 190 191 static int crypto_xcbc_digest_update(struct hash_desc *pdesc, 192 struct scatterlist *sg, 193 unsigned int nbytes) 194 { 195 if (WARN_ON_ONCE(in_irq())) 196 return -EDEADLK; 197 return crypto_xcbc_digest_update2(pdesc, sg, nbytes); 198 } 199 200 static int crypto_xcbc_digest_final(struct hash_desc *pdesc, u8 *out) 201 { 202 struct crypto_hash *parent = pdesc->tfm; 203 struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(parent); 204 struct crypto_cipher *tfm = ctx->child; 205 int bs = crypto_hash_blocksize(parent); 206 int err = 0; 207 208 if (ctx->len == bs) { 209 u8 key2[bs]; 210 211 if ((err = crypto_cipher_setkey(tfm, ctx->key, ctx->keylen)) != 0) 212 return err; 213 214 crypto_cipher_encrypt_one(tfm, key2, 215 (u8 *)(ctx->consts + bs)); 216 217 ctx->xor(ctx->prev, ctx->odds, bs); 218 ctx->xor(ctx->prev, key2, bs); 219 _crypto_xcbc_digest_setkey(parent, ctx); 220 221 crypto_cipher_encrypt_one(tfm, out, ctx->prev); 222 } else { 223 u8 key3[bs]; 224 unsigned int rlen; 225 u8 *p = ctx->odds + ctx->len; 226 *p = 0x80; 227 p++; 228 229 rlen = bs - ctx->len -1; 230 if (rlen) 231 memset(p, 0, rlen); 232 233 if ((err = crypto_cipher_setkey(tfm, ctx->key, ctx->keylen)) != 0) 234 return err; 235 236 crypto_cipher_encrypt_one(tfm, key3, 237 (u8 *)(ctx->consts + bs * 2)); 238 239 ctx->xor(ctx->prev, ctx->odds, bs); 240 ctx->xor(ctx->prev, key3, bs); 241 242 _crypto_xcbc_digest_setkey(parent, ctx); 243 244 crypto_cipher_encrypt_one(tfm, out, ctx->prev); 245 } 246 247 return 0; 248 } 249 250 static int crypto_xcbc_digest(struct hash_desc *pdesc, 251 struct scatterlist *sg, unsigned int nbytes, u8 *out) 252 { 253 if (WARN_ON_ONCE(in_irq())) 254 return -EDEADLK; 255 256 crypto_xcbc_digest_init(pdesc); 257 crypto_xcbc_digest_update2(pdesc, sg, nbytes); 258 return crypto_xcbc_digest_final(pdesc, out); 259 } 260 261 static int xcbc_init_tfm(struct crypto_tfm *tfm) 262 { 263 struct crypto_cipher *cipher; 264 struct crypto_instance *inst = (void *)tfm->__crt_alg; 265 struct crypto_spawn *spawn = crypto_instance_ctx(inst); 266 struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(__crypto_hash_cast(tfm)); 267 int bs = crypto_hash_blocksize(__crypto_hash_cast(tfm)); 268 269 cipher = crypto_spawn_cipher(spawn); 270 if (IS_ERR(cipher)) 271 return PTR_ERR(cipher); 272 273 switch(bs) { 274 case 16: 275 ctx->xor = xor_128; 276 break; 277 default: 278 return -EINVAL; 279 } 280 281 ctx->child = cipher; 282 ctx->odds = (u8*)(ctx+1); 283 ctx->prev = ctx->odds + bs; 284 ctx->key = ctx->prev + bs; 285 286 return 0; 287 }; 288 289 static void xcbc_exit_tfm(struct crypto_tfm *tfm) 290 { 291 struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(__crypto_hash_cast(tfm)); 292 crypto_free_cipher(ctx->child); 293 } 294 295 static struct crypto_instance *xcbc_alloc(struct rtattr **tb) 296 { 297 struct crypto_instance *inst; 298 struct crypto_alg *alg; 299 int err; 300 301 err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_HASH); 302 if (err) 303 return ERR_PTR(err); 304 305 alg = crypto_get_attr_alg(tb, CRYPTO_ALG_TYPE_CIPHER, 306 CRYPTO_ALG_TYPE_MASK); 307 if (IS_ERR(alg)) 308 return ERR_CAST(alg); 309 310 switch(alg->cra_blocksize) { 311 case 16: 312 break; 313 default: 314 inst = ERR_PTR(-EINVAL); 315 goto out_put_alg; 316 } 317 318 inst = crypto_alloc_instance("xcbc", alg); 319 if (IS_ERR(inst)) 320 goto out_put_alg; 321 322 inst->alg.cra_flags = CRYPTO_ALG_TYPE_HASH; 323 inst->alg.cra_priority = alg->cra_priority; 324 inst->alg.cra_blocksize = alg->cra_blocksize; 325 inst->alg.cra_alignmask = alg->cra_alignmask; 326 inst->alg.cra_type = &crypto_hash_type; 327 328 inst->alg.cra_hash.digestsize = alg->cra_blocksize; 329 inst->alg.cra_ctxsize = sizeof(struct crypto_xcbc_ctx) + 330 ALIGN(inst->alg.cra_blocksize * 3, sizeof(void *)); 331 inst->alg.cra_init = xcbc_init_tfm; 332 inst->alg.cra_exit = xcbc_exit_tfm; 333 334 inst->alg.cra_hash.init = crypto_xcbc_digest_init; 335 inst->alg.cra_hash.update = crypto_xcbc_digest_update; 336 inst->alg.cra_hash.final = crypto_xcbc_digest_final; 337 inst->alg.cra_hash.digest = crypto_xcbc_digest; 338 inst->alg.cra_hash.setkey = crypto_xcbc_digest_setkey; 339 340 out_put_alg: 341 crypto_mod_put(alg); 342 return inst; 343 } 344 345 static void xcbc_free(struct crypto_instance *inst) 346 { 347 crypto_drop_spawn(crypto_instance_ctx(inst)); 348 kfree(inst); 349 } 350 351 static struct crypto_template crypto_xcbc_tmpl = { 352 .name = "xcbc", 353 .alloc = xcbc_alloc, 354 .free = xcbc_free, 355 .module = THIS_MODULE, 356 }; 357 358 static int __init crypto_xcbc_module_init(void) 359 { 360 return crypto_register_template(&crypto_xcbc_tmpl); 361 } 362 363 static void __exit crypto_xcbc_module_exit(void) 364 { 365 crypto_unregister_template(&crypto_xcbc_tmpl); 366 } 367 368 module_init(crypto_xcbc_module_init); 369 module_exit(crypto_xcbc_module_exit); 370 371 MODULE_LICENSE("GPL"); 372 MODULE_DESCRIPTION("XCBC keyed hash algorithm"); 373