crypto/algif_aead.c

   1 /*
   2  * algif_aead: User-space interface for AEAD algorithms
   3  *
   4  * Copyright (C) 2014, Stephan Mueller <smueller@chronox.de>
   5  *
   6  * This file provides the user-space API for AEAD ciphers.
   7  *
   8  * This file is derived from algif_skcipher.c.
   9  *
  10  * This program is free software; you can redistribute it and/or modify it
  11  * under the terms of the GNU General Public License as published by the Free
  12  * Software Foundation; either version 2 of the License, or (at your option)
  13  * any later version.
  14  */
  15
  16 #include <crypto/scatterwalk.h>
  17 #include <crypto/if_alg.h>
  18 #include <linux/init.h>
  19 #include <linux/list.h>
  20 #include <linux/kernel.h>
  21 #include <linux/mm.h>
  22 #include <linux/module.h>
  23 #include <linux/net.h>
  24 #include <net/sock.h>
  25
  26 struct aead_sg_list {
  27         unsigned int cur;
  28         struct scatterlist sg[ALG_MAX_PAGES];
  29 };
  30
  31 struct aead_ctx {
  32         struct aead_sg_list tsgl;
  33         /*
  34          * RSGL_MAX_ENTRIES is an artificial limit where user space at maximum
  35          * can cause the kernel to allocate RSGL_MAX_ENTRIES * ALG_MAX_PAGES
  36          * bytes
  37          */
  38 #define RSGL_MAX_ENTRIES ALG_MAX_PAGES
  39         struct af_alg_sgl rsgl[RSGL_MAX_ENTRIES];
  40
  41         void *iv;
  42
  43         struct af_alg_completion completion;
  44
  45         unsigned long used;
  46
  47         unsigned int len;
  48         bool more;
  49         bool merge;
  50         bool enc;
  51
  52         size_t aead_assoclen;
  53         struct aead_request aead_req;
  54 };
  55
  56 static inline int aead_sndbuf(struct sock *sk)
  57 {
  58         struct alg_sock *ask = alg_sk(sk);
  59         struct aead_ctx *ctx = ask->private;
  60
  61         return max_t(int, max_t(int, sk->sk_sndbuf & PAGE_MASK, PAGE_SIZE) -
  62                           ctx->used, 0);
  63 }
  64
  65 static inline bool aead_writable(struct sock *sk)
  66 {
  67         return PAGE_SIZE <= aead_sndbuf(sk);
  68 }
  69
  70 static inline bool aead_sufficient_data(struct aead_ctx *ctx)
  71 {
  72         unsigned as = crypto_aead_authsize(crypto_aead_reqtfm(&ctx->aead_req));
  73
  74         return (ctx->used >= (ctx->aead_assoclen + (ctx->enc ? 0 : as)));
  75 }
  76
  77 static void aead_put_sgl(struct sock *sk)
  78 {
  79         struct alg_sock *ask = alg_sk(sk);
  80         struct aead_ctx *ctx = ask->private;
  81         struct aead_sg_list *sgl = &ctx->tsgl;
  82         struct scatterlist *sg = sgl->sg;
  83         unsigned int i;
  84
  85         for (i = 0; i < sgl->cur; i++) {
  86                 if (!sg_page(sg + i))
  87                         continue;
  88
  89                 put_page(sg_page(sg + i));
  90                 sg_assign_page(sg + i, NULL);
  91         }
  92         sgl->cur = 0;
  93         ctx->used = 0;
  94         ctx->more = 0;
  95         ctx->merge = 0;
  96 }
  97
  98 static void aead_wmem_wakeup(struct sock *sk)
  99 {
 100         struct socket_wq *wq;
 101
 102         if (!aead_writable(sk))
 103                 return;
 104
 105         rcu_read_lock();
 106         wq = rcu_dereference(sk->sk_wq);
 107         if (wq_has_sleeper(wq))
 108                 wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
 109                                                            POLLRDNORM |
 110                                                            POLLRDBAND);
 111         sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
 112         rcu_read_unlock();
 113 }
 114
 115 static int aead_wait_for_data(struct sock *sk, unsigned flags)
 116 {
 117         struct alg_sock *ask = alg_sk(sk);
 118         struct aead_ctx *ctx = ask->private;
 119         long timeout;
 120         DEFINE_WAIT(wait);
 121         int err = -ERESTARTSYS;
 122
 123         if (flags & MSG_DONTWAIT)
 124                 return -EAGAIN;
 125
 126         set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 127
 128         for (;;) {
 129                 if (signal_pending(current))
 130                         break;
 131                 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 132                 timeout = MAX_SCHEDULE_TIMEOUT;
 133                 if (sk_wait_event(sk, &timeout, !ctx->more)) {
 134                         err = 0;
 135                         break;
 136                 }
 137         }
 138         finish_wait(sk_sleep(sk), &wait);
 139
 140         clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 141
 142         return err;
 143 }
 144
 145 static void aead_data_wakeup(struct sock *sk)
 146 {
 147         struct alg_sock *ask = alg_sk(sk);
 148         struct aead_ctx *ctx = ask->private;
 149         struct socket_wq *wq;
 150
 151         if (ctx->more)
 152                 return;
 153         if (!ctx->used)
 154                 return;
 155
 156         rcu_read_lock();
 157         wq = rcu_dereference(sk->sk_wq);
 158         if (wq_has_sleeper(wq))
 159                 wake_up_interruptible_sync_poll(&wq->wait, POLLOUT |
 160                                                            POLLRDNORM |
 161                                                            POLLRDBAND);
 162         sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
 163         rcu_read_unlock();
 164 }
 165
 166 static int aead_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 167 {
 168         struct sock *sk = sock->sk;
 169         struct alg_sock *ask = alg_sk(sk);
 170         struct aead_ctx *ctx = ask->private;
 171         unsigned ivsize =
 172                 crypto_aead_ivsize(crypto_aead_reqtfm(&ctx->aead_req));
 173         struct aead_sg_list *sgl = &ctx->tsgl;
 174         struct af_alg_control con = {};
 175         long copied = 0;
 176         bool enc = 0;
 177         bool init = 0;
 178         int err = -EINVAL;
 179
 180         if (msg->msg_controllen) {
 181                 err = af_alg_cmsg_send(msg, &con);
 182                 if (err)
 183                         return err;
 184
 185                 init = 1;
 186                 switch (con.op) {
 187                 case ALG_OP_ENCRYPT:
 188                         enc = 1;
 189                         break;
 190                 case ALG_OP_DECRYPT:
 191                         enc = 0;
 192                         break;
 193                 default:
 194                         return -EINVAL;
 195                 }
 196
 197                 if (con.iv && con.iv->ivlen != ivsize)
 198                         return -EINVAL;
 199         }
 200
 201         lock_sock(sk);
 202         if (!ctx->more && ctx->used)
 203                 goto unlock;
 204
 205         if (init) {
 206                 ctx->enc = enc;
 207                 if (con.iv)
 208                         memcpy(ctx->iv, con.iv->iv, ivsize);
 209
 210                 ctx->aead_assoclen = con.aead_assoclen;
 211         }
 212
 213         while (size) {
 214                 unsigned long len = size;
 215                 struct scatterlist *sg = NULL;
 216
 217                 /* use the existing memory in an allocated page */
 218                 if (ctx->merge) {
 219                         sg = sgl->sg + sgl->cur - 1;
 220                         len = min_t(unsigned long, len,
 221                                     PAGE_SIZE - sg->offset - sg->length);
 222                         err = memcpy_from_msg(page_address(sg_page(sg)) +
 223                                               sg->offset + sg->length,
 224                                               msg, len);
 225                         if (err)
 226                                 goto unlock;
 227
 228                         sg->length += len;
 229                         ctx->merge = (sg->offset + sg->length) &
 230                                      (PAGE_SIZE - 1);
 231
 232                         ctx->used += len;
 233                         copied += len;
 234                         size -= len;
 235                         continue;
 236                 }
 237
 238                 if (!aead_writable(sk)) {
 239                         /* user space sent too much data */
 240                         aead_put_sgl(sk);
 241                         err = -EMSGSIZE;
 242                         goto unlock;
 243                 }
 244
 245                 /* allocate a new page */
 246                 len = min_t(unsigned long, size, aead_sndbuf(sk));
 247                 while (len) {
 248                         int plen = 0;
 249
 250                         if (sgl->cur >= ALG_MAX_PAGES) {
 251                                 aead_put_sgl(sk);
 252                                 err = -E2BIG;
 253                                 goto unlock;
 254                         }
 255
 256                         sg = sgl->sg + sgl->cur;
 257                         plen = min_t(int, len, PAGE_SIZE);
 258
 259                         sg_assign_page(sg, alloc_page(GFP_KERNEL));
 260                         err = -ENOMEM;
 261                         if (!sg_page(sg))
 262                                 goto unlock;
 263
 264                         err = memcpy_from_msg(page_address(sg_page(sg)),
 265                                               msg, plen);
 266                         if (err) {
 267                                 __free_page(sg_page(sg));
 268                                 sg_assign_page(sg, NULL);
 269                                 goto unlock;
 270                         }
 271
 272                         sg->offset = 0;
 273                         sg->length = plen;
 274                         len -= plen;
 275                         ctx->used += plen;
 276                         copied += plen;
 277                         sgl->cur++;
 278                         size -= plen;
 279                         ctx->merge = plen & (PAGE_SIZE - 1);
 280                 }
 281         }
 282
 283         err = 0;
 284
 285         ctx->more = msg->msg_flags & MSG_MORE;
 286         if (!ctx->more && !aead_sufficient_data(ctx)) {
 287                 aead_put_sgl(sk);
 288                 err = -EMSGSIZE;
 289         }
 290
 291 unlock:
 292         aead_data_wakeup(sk);
 293         release_sock(sk);
 294
 295         return err ?: copied;
 296 }
 297
 298 static ssize_t aead_sendpage(struct socket *sock, struct page *page,
 299                              int offset, size_t size, int flags)
 300 {
 301         struct sock *sk = sock->sk;
 302         struct alg_sock *ask = alg_sk(sk);
 303         struct aead_ctx *ctx = ask->private;
 304         struct aead_sg_list *sgl = &ctx->tsgl;
 305         int err = -EINVAL;
 306
 307         if (flags & MSG_SENDPAGE_NOTLAST)
 308                 flags |= MSG_MORE;
 309
 310         if (sgl->cur >= ALG_MAX_PAGES)
 311                 return -E2BIG;
 312
 313         lock_sock(sk);
 314         if (!ctx->more && ctx->used)
 315                 goto unlock;
 316
 317         if (!size)
 318                 goto done;
 319
 320         if (!aead_writable(sk)) {
 321                 /* user space sent too much data */
 322                 aead_put_sgl(sk);
 323                 err = -EMSGSIZE;
 324                 goto unlock;
 325         }
 326
 327         ctx->merge = 0;
 328
 329         get_page(page);
 330         sg_set_page(sgl->sg + sgl->cur, page, size, offset);
 331         sgl->cur++;
 332         ctx->used += size;
 333
 334         err = 0;
 335
 336 done:
 337         ctx->more = flags & MSG_MORE;
 338         if (!ctx->more && !aead_sufficient_data(ctx)) {
 339                 aead_put_sgl(sk);
 340                 err = -EMSGSIZE;
 341         }
 342
 343 unlock:
 344         aead_data_wakeup(sk);
 345         release_sock(sk);
 346
 347         return err ?: size;
 348 }
 349
 350 static int aead_recvmsg(struct socket *sock, struct msghdr *msg, size_t ignored, int flags)
 351 {
 352         struct sock *sk = sock->sk;
 353         struct alg_sock *ask = alg_sk(sk);
 354         struct aead_ctx *ctx = ask->private;
 355         unsigned bs = crypto_aead_blocksize(crypto_aead_reqtfm(&ctx->aead_req));
 356         unsigned as = crypto_aead_authsize(crypto_aead_reqtfm(&ctx->aead_req));
 357         struct aead_sg_list *sgl = &ctx->tsgl;
 358         struct scatterlist *sg = NULL;
 359         struct scatterlist assoc[ALG_MAX_PAGES];
 360         size_t assoclen = 0;
 361         unsigned int i = 0;
 362         int err = -EINVAL;
 363         unsigned long used = 0;
 364         size_t outlen = 0;
 365         size_t usedpages = 0;
 366         unsigned int cnt = 0;
 367
 368         /* Limit number of IOV blocks to be accessed below */
 369         if (msg->msg_iter.nr_segs > RSGL_MAX_ENTRIES)
 370                 return -ENOMSG;
 371
 372         lock_sock(sk);
 373
 374         /*
 375          * AEAD memory structure: For encryption, the tag is appended to the
 376          * ciphertext which implies that the memory allocated for the ciphertext
 377          * must be increased by the tag length. For decryption, the tag
 378          * is expected to be concatenated to the ciphertext. The plaintext
 379          * therefore has a memory size of the ciphertext minus the tag length.
 380          *
 381          * The memory structure for cipher operation has the following
 382          * structure:
 383          *      AEAD encryption input:  assoc data || plaintext
 384          *      AEAD encryption output: cipherntext || auth tag
 385          *      AEAD decryption input:  assoc data || ciphertext || auth tag
 386          *      AEAD decryption output: plaintext
 387          */
 388
 389         if (ctx->more) {
 390                 err = aead_wait_for_data(sk, flags);
 391                 if (err)
 392                         goto unlock;
 393         }
 394
 395         used = ctx->used;
 396
 397         /*
 398          * Make sure sufficient data is present -- note, the same check is
 399          * is also present in sendmsg/sendpage. The checks in sendpage/sendmsg
 400          * shall provide an information to the data sender that something is
 401          * wrong, but they are irrelevant to maintain the kernel integrity.
 402          * We need this check here too in case user space decides to not honor
 403          * the error message in sendmsg/sendpage and still call recvmsg. This
 404          * check here protects the kernel integrity.
 405          */
 406         if (!aead_sufficient_data(ctx))
 407                 goto unlock;
 408
 409         /*
 410          * The cipher operation input data is reduced by the associated data
 411          * length as this data is processed separately later on.
 412          */
 413         used -= ctx->aead_assoclen;
 414
 415         if (ctx->enc) {
 416                 /* round up output buffer to multiple of block size */
 417                 outlen = ((used + bs - 1) / bs * bs);
 418                 /* add the size needed for the auth tag to be created */
 419                 outlen += as;
 420         } else {
 421                 /* output data size is input without the authentication tag */
 422                 outlen = used - as;
 423                 /* round up output buffer to multiple of block size */
 424                 outlen = ((outlen + bs - 1) / bs * bs);
 425         }
 426
 427         /* convert iovecs of output buffers into scatterlists */
 428         while (iov_iter_count(&msg->msg_iter)) {
 429                 size_t seglen = min_t(size_t, iov_iter_count(&msg->msg_iter),
 430                                       (outlen - usedpages));
 431
 432                 /* make one iovec available as scatterlist */
 433                 err = af_alg_make_sg(&ctx->rsgl[cnt], &msg->msg_iter,
 434                                      seglen);
 435                 if (err < 0)
 436                         goto unlock;
 437                 usedpages += err;
 438                 /* chain the new scatterlist with initial list */
 439                 if (cnt)
 440                         scatterwalk_crypto_chain(ctx->rsgl[0].sg,
 441                                         ctx->rsgl[cnt].sg, 1,
 442                                         sg_nents(ctx->rsgl[cnt-1].sg));
 443                 /* we do not need more iovecs as we have sufficient memory */
 444                 if (outlen <= usedpages)
 445                         break;
 446                 iov_iter_advance(&msg->msg_iter, err);
 447                 cnt++;
 448         }
 449
 450         err = -EINVAL;
 451         /* ensure output buffer is sufficiently large */
 452         if (usedpages < outlen)
 453                 goto unlock;
 454
 455         sg_init_table(assoc, ALG_MAX_PAGES);
 456         assoclen = ctx->aead_assoclen;
 457         /*
 458          * Split scatterlist into two: first part becomes AD, second part
 459          * is plaintext / ciphertext. The first part is assigned to assoc
 460          * scatterlist. When this loop finishes, sg points to the start of the
 461          * plaintext / ciphertext.
 462          */
 463         for (i = 0; i < ctx->tsgl.cur; i++) {
 464                 sg = sgl->sg + i;
 465                 if (sg->length <= assoclen) {
 466                         /* AD is larger than one page */
 467                         sg_set_page(assoc + i, sg_page(sg),
 468                                     sg->length, sg->offset);
 469                         assoclen -= sg->length;
 470                         if (i >= ctx->tsgl.cur)
 471                                 goto unlock;
 472                 } else if (!assoclen) {
 473                         /* current page is to start of plaintext / ciphertext */
 474                         if (i)
 475                                 /* AD terminates at page boundary */
 476                                 sg_mark_end(assoc + i - 1);
 477                         else
 478                                 /* AD size is zero */
 479                                 sg_mark_end(assoc);
 480                         break;
 481                 } else {
 482                         /* AD does not terminate at page boundary */
 483                         sg_set_page(assoc + i, sg_page(sg),
 484                                     assoclen, sg->offset);
 485                         sg_mark_end(assoc + i);
 486                         /* plaintext / ciphertext starts after AD */
 487                         sg->length -= assoclen;
 488                         sg->offset += assoclen;
 489                         break;
 490                 }
 491         }
 492
 493         aead_request_set_assoc(&ctx->aead_req, assoc, ctx->aead_assoclen);
 494         aead_request_set_crypt(&ctx->aead_req, sg, ctx->rsgl[0].sg, used,
 495                                ctx->iv);
 496
 497         err = af_alg_wait_for_completion(ctx->enc ?
 498                                          crypto_aead_encrypt(&ctx->aead_req) :
 499                                          crypto_aead_decrypt(&ctx->aead_req),
 500                                          &ctx->completion);
 501
 502         if (err) {
 503                 /* EBADMSG implies a valid cipher operation took place */
 504                 if (err == -EBADMSG)
 505                         aead_put_sgl(sk);
 506                 goto unlock;
 507         }
 508
 509         aead_put_sgl(sk);
 510
 511         err = 0;
 512
 513 unlock:
 514         for (i = 0; i < cnt; i++)
 515                 af_alg_free_sg(&ctx->rsgl[i]);
 516
 517         aead_wmem_wakeup(sk);
 518         release_sock(sk);
 519
 520         return err ? err : outlen;
 521 }
 522
 523 static unsigned int aead_poll(struct file *file, struct socket *sock,
 524                               poll_table *wait)
 525 {
 526         struct sock *sk = sock->sk;
 527         struct alg_sock *ask = alg_sk(sk);
 528         struct aead_ctx *ctx = ask->private;
 529         unsigned int mask;
 530
 531         sock_poll_wait(file, sk_sleep(sk), wait);
 532         mask = 0;
 533
 534         if (!ctx->more)
 535                 mask |= POLLIN | POLLRDNORM;
 536
 537         if (aead_writable(sk))
 538                 mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
 539
 540         return mask;
 541 }
 542
 543 static struct proto_ops algif_aead_ops = {
 544         .family         =       PF_ALG,
 545
 546         .connect        =       sock_no_connect,
 547         .socketpair     =       sock_no_socketpair,
 548         .getname        =       sock_no_getname,
 549         .ioctl          =       sock_no_ioctl,
 550         .listen         =       sock_no_listen,
 551         .shutdown       =       sock_no_shutdown,
 552         .getsockopt     =       sock_no_getsockopt,
 553         .mmap           =       sock_no_mmap,
 554         .bind           =       sock_no_bind,
 555         .accept         =       sock_no_accept,
 556         .setsockopt     =       sock_no_setsockopt,
 557
 558         .release        =       af_alg_release,
 559         .sendmsg        =       aead_sendmsg,
 560         .sendpage       =       aead_sendpage,
 561         .recvmsg        =       aead_recvmsg,
 562         .poll           =       aead_poll,
 563 };
 564
 565 static void *aead_bind(const char *name, u32 type, u32 mask)
 566 {
 567         return crypto_alloc_aead(name, type, mask);
 568 }
 569
 570 static void aead_release(void *private)
 571 {
 572         crypto_free_aead(private);
 573 }
 574
 575 static int aead_setauthsize(void *private, unsigned int authsize)
 576 {
 577         return crypto_aead_setauthsize(private, authsize);
 578 }
 579
 580 static int aead_setkey(void *private, const u8 *key, unsigned int keylen)
 581 {
 582         return crypto_aead_setkey(private, key, keylen);
 583 }
 584
 585 static void aead_sock_destruct(struct sock *sk)
 586 {
 587         struct alg_sock *ask = alg_sk(sk);
 588         struct aead_ctx *ctx = ask->private;
 589         unsigned int ivlen = crypto_aead_ivsize(
 590                                 crypto_aead_reqtfm(&ctx->aead_req));
 591
 592         aead_put_sgl(sk);
 593         sock_kzfree_s(sk, ctx->iv, ivlen);
 594         sock_kfree_s(sk, ctx, ctx->len);
 595         af_alg_release_parent(sk);
 596 }
 597
 598 static int aead_accept_parent(void *private, struct sock *sk)
 599 {
 600         struct aead_ctx *ctx;
 601         struct alg_sock *ask = alg_sk(sk);
 602         unsigned int len = sizeof(*ctx) + crypto_aead_reqsize(private);
 603         unsigned int ivlen = crypto_aead_ivsize(private);
 604
 605         ctx = sock_kmalloc(sk, len, GFP_KERNEL);
 606         if (!ctx)
 607                 return -ENOMEM;
 608         memset(ctx, 0, len);
 609
 610         ctx->iv = sock_kmalloc(sk, ivlen, GFP_KERNEL);
 611         if (!ctx->iv) {
 612                 sock_kfree_s(sk, ctx, len);
 613                 return -ENOMEM;
 614         }
 615         memset(ctx->iv, 0, ivlen);
 616
 617         ctx->len = len;
 618         ctx->used = 0;
 619         ctx->more = 0;
 620         ctx->merge = 0;
 621         ctx->enc = 0;
 622         ctx->tsgl.cur = 0;
 623         ctx->aead_assoclen = 0;
 624         af_alg_init_completion(&ctx->completion);
 625         sg_init_table(ctx->tsgl.sg, ALG_MAX_PAGES);
 626
 627         ask->private = ctx;
 628
 629         aead_request_set_tfm(&ctx->aead_req, private);
 630         aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG,
 631                                   af_alg_complete, &ctx->completion);
 632
 633         sk->sk_destruct = aead_sock_destruct;
 634
 635         return 0;
 636 }
 637
 638 static const struct af_alg_type algif_type_aead = {
 639         .bind           =       aead_bind,
 640         .release        =       aead_release,
 641         .setkey         =       aead_setkey,
 642         .setauthsize    =       aead_setauthsize,
 643         .accept         =       aead_accept_parent,
 644         .ops            =       &algif_aead_ops,
 645         .name           =       "aead",
 646         .owner          =       THIS_MODULE
 647 };
 648
 649 static int __init algif_aead_init(void)
 650 {
 651         return af_alg_register_type(&algif_type_aead);
 652 }
 653
 654 static void __exit algif_aead_exit(void)
 655 {
 656         int err = af_alg_unregister_type(&algif_type_aead);
 657         BUG_ON(err);
 658 }
 659
 660 module_init(algif_aead_init);
 661 module_exit(algif_aead_exit);
 662 MODULE_LICENSE("GPL");
 663 MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
 664 MODULE_DESCRIPTION("AEAD kernel crypto API user space interface");