crypto/ccm.c

   1 /*
   2  * CCM: Counter with CBC-MAC
   3  *
   4  * (C) Copyright IBM Corp. 2007 - Joy Latten <latten@us.ibm.com>
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the Free
   8  * Software Foundation; either version 2 of the License, or (at your option)
   9  * any later version.
  10  *
  11  */
  12
  13 #include <crypto/internal/aead.h>
  14 #include <crypto/internal/skcipher.h>
  15 #include <crypto/scatterwalk.h>
  16 #include <linux/err.h>
  17 #include <linux/init.h>
  18 #include <linux/kernel.h>
  19 #include <linux/module.h>
  20 #include <linux/slab.h>
  21
  22 #include "internal.h"
  23
  24 struct ccm_instance_ctx {
  25         struct crypto_skcipher_spawn ctr;
  26         struct crypto_spawn cipher;
  27 };
  28
  29 struct crypto_ccm_ctx {
  30         struct crypto_cipher *cipher;
  31         struct crypto_skcipher *ctr;
  32 };
  33
  34 struct crypto_rfc4309_ctx {
  35         struct crypto_aead *child;
  36         u8 nonce[3];
  37 };
  38
  39 struct crypto_rfc4309_req_ctx {
  40         struct scatterlist src[3];
  41         struct scatterlist dst[3];
  42         struct aead_request subreq;
  43 };
  44
  45 struct crypto_ccm_req_priv_ctx {
  46         u8 odata[16];
  47         u8 idata[16];
  48         u8 auth_tag[16];
  49         u32 ilen;
  50         u32 flags;
  51         struct scatterlist src[3];
  52         struct scatterlist dst[3];
  53         struct skcipher_request skreq;
  54 };
  55
  56 static inline struct crypto_ccm_req_priv_ctx *crypto_ccm_reqctx(
  57         struct aead_request *req)
  58 {
  59         unsigned long align = crypto_aead_alignmask(crypto_aead_reqtfm(req));
  60
  61         return (void *)PTR_ALIGN((u8 *)aead_request_ctx(req), align + 1);
  62 }
  63
  64 static int set_msg_len(u8 *block, unsigned int msglen, int csize)
  65 {
  66         __be32 data;
  67
  68         memset(block, 0, csize);
  69         block += csize;
  70
  71         if (csize >= 4)
  72                 csize = 4;
  73         else if (msglen > (1 << (8 * csize)))
  74                 return -EOVERFLOW;
  75
  76         data = cpu_to_be32(msglen);
  77         memcpy(block - csize, (u8 *)&data + 4 - csize, csize);
  78
  79         return 0;
  80 }
  81
  82 static int crypto_ccm_setkey(struct crypto_aead *aead, const u8 *key,
  83                              unsigned int keylen)
  84 {
  85         struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
  86         struct crypto_skcipher *ctr = ctx->ctr;
  87         struct crypto_cipher *tfm = ctx->cipher;
  88         int err = 0;
  89
  90         crypto_skcipher_clear_flags(ctr, CRYPTO_TFM_REQ_MASK);
  91         crypto_skcipher_set_flags(ctr, crypto_aead_get_flags(aead) &
  92                                        CRYPTO_TFM_REQ_MASK);
  93         err = crypto_skcipher_setkey(ctr, key, keylen);
  94         crypto_aead_set_flags(aead, crypto_skcipher_get_flags(ctr) &
  95                               CRYPTO_TFM_RES_MASK);
  96         if (err)
  97                 goto out;
  98
  99         crypto_cipher_clear_flags(tfm, CRYPTO_TFM_REQ_MASK);
 100         crypto_cipher_set_flags(tfm, crypto_aead_get_flags(aead) &
 101                                     CRYPTO_TFM_REQ_MASK);
 102         err = crypto_cipher_setkey(tfm, key, keylen);
 103         crypto_aead_set_flags(aead, crypto_cipher_get_flags(tfm) &
 104                               CRYPTO_TFM_RES_MASK);
 105
 106 out:
 107         return err;
 108 }
 109
 110 static int crypto_ccm_setauthsize(struct crypto_aead *tfm,
 111                                   unsigned int authsize)
 112 {
 113         switch (authsize) {
 114         case 4:
 115         case 6:
 116         case 8:
 117         case 10:
 118         case 12:
 119         case 14:
 120         case 16:
 121                 break;
 122         default:
 123                 return -EINVAL;
 124         }
 125
 126         return 0;
 127 }
 128
 129 static int format_input(u8 *info, struct aead_request *req,
 130                         unsigned int cryptlen)
 131 {
 132         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 133         unsigned int lp = req->iv[0];
 134         unsigned int l = lp + 1;
 135         unsigned int m;
 136
 137         m = crypto_aead_authsize(aead);
 138
 139         memcpy(info, req->iv, 16);
 140
 141         /* format control info per RFC 3610 and
 142          * NIST Special Publication 800-38C
 143          */
 144         *info |= (8 * ((m - 2) / 2));
 145         if (req->assoclen)
 146                 *info |= 64;
 147
 148         return set_msg_len(info + 16 - l, cryptlen, l);
 149 }
 150
 151 static int format_adata(u8 *adata, unsigned int a)
 152 {
 153         int len = 0;
 154
 155         /* add control info for associated data
 156          * RFC 3610 and NIST Special Publication 800-38C
 157          */
 158         if (a < 65280) {
 159                 *(__be16 *)adata = cpu_to_be16(a);
 160                 len = 2;
 161         } else  {
 162                 *(__be16 *)adata = cpu_to_be16(0xfffe);
 163                 *(__be32 *)&adata[2] = cpu_to_be32(a);
 164                 len = 6;
 165         }
 166
 167         return len;
 168 }
 169
 170 static void compute_mac(struct crypto_cipher *tfm, u8 *data, int n,
 171                        struct crypto_ccm_req_priv_ctx *pctx)
 172 {
 173         unsigned int bs = 16;
 174         u8 *odata = pctx->odata;
 175         u8 *idata = pctx->idata;
 176         int datalen, getlen;
 177
 178         datalen = n;
 179
 180         /* first time in here, block may be partially filled. */
 181         getlen = bs - pctx->ilen;
 182         if (datalen >= getlen) {
 183                 memcpy(idata + pctx->ilen, data, getlen);
 184                 crypto_xor(odata, idata, bs);
 185                 crypto_cipher_encrypt_one(tfm, odata, odata);
 186                 datalen -= getlen;
 187                 data += getlen;
 188                 pctx->ilen = 0;
 189         }
 190
 191         /* now encrypt rest of data */
 192         while (datalen >= bs) {
 193                 crypto_xor(odata, data, bs);
 194                 crypto_cipher_encrypt_one(tfm, odata, odata);
 195
 196                 datalen -= bs;
 197                 data += bs;
 198         }
 199
 200         /* check and see if there's leftover data that wasn't
 201          * enough to fill a block.
 202          */
 203         if (datalen) {
 204                 memcpy(idata + pctx->ilen, data, datalen);
 205                 pctx->ilen += datalen;
 206         }
 207 }
 208
 209 static void get_data_to_compute(struct crypto_cipher *tfm,
 210                                struct crypto_ccm_req_priv_ctx *pctx,
 211                                struct scatterlist *sg, unsigned int len)
 212 {
 213         struct scatter_walk walk;
 214         u8 *data_src;
 215         int n;
 216
 217         scatterwalk_start(&walk, sg);
 218
 219         while (len) {
 220                 n = scatterwalk_clamp(&walk, len);
 221                 if (!n) {
 222                         scatterwalk_start(&walk, sg_next(walk.sg));
 223                         n = scatterwalk_clamp(&walk, len);
 224                 }
 225                 data_src = scatterwalk_map(&walk);
 226
 227                 compute_mac(tfm, data_src, n, pctx);
 228                 len -= n;
 229
 230                 scatterwalk_unmap(data_src);
 231                 scatterwalk_advance(&walk, n);
 232                 scatterwalk_done(&walk, 0, len);
 233                 if (len)
 234                         crypto_yield(pctx->flags);
 235         }
 236
 237         /* any leftover needs padding and then encrypted */
 238         if (pctx->ilen) {
 239                 int padlen;
 240                 u8 *odata = pctx->odata;
 241                 u8 *idata = pctx->idata;
 242
 243                 padlen = 16 - pctx->ilen;
 244                 memset(idata + pctx->ilen, 0, padlen);
 245                 crypto_xor(odata, idata, 16);
 246                 crypto_cipher_encrypt_one(tfm, odata, odata);
 247                 pctx->ilen = 0;
 248         }
 249 }
 250
 251 static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain,
 252                            unsigned int cryptlen)
 253 {
 254         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 255         struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
 256         struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
 257         struct crypto_cipher *cipher = ctx->cipher;
 258         unsigned int assoclen = req->assoclen;
 259         u8 *odata = pctx->odata;
 260         u8 *idata = pctx->idata;
 261         int err;
 262
 263         /* format control data for input */
 264         err = format_input(odata, req, cryptlen);
 265         if (err)
 266                 goto out;
 267
 268         /* encrypt first block to use as start in computing mac  */
 269         crypto_cipher_encrypt_one(cipher, odata, odata);
 270
 271         /* format associated data and compute into mac */
 272         if (assoclen) {
 273                 pctx->ilen = format_adata(idata, assoclen);
 274                 get_data_to_compute(cipher, pctx, req->src, req->assoclen);
 275         } else {
 276                 pctx->ilen = 0;
 277         }
 278
 279         /* compute plaintext into mac */
 280         if (cryptlen)
 281                 get_data_to_compute(cipher, pctx, plain, cryptlen);
 282
 283 out:
 284         return err;
 285 }
 286
 287 static void crypto_ccm_encrypt_done(struct crypto_async_request *areq, int err)
 288 {
 289         struct aead_request *req = areq->data;
 290         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 291         struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
 292         u8 *odata = pctx->odata;
 293
 294         if (!err)
 295                 scatterwalk_map_and_copy(odata, req->dst,
 296                                          req->assoclen + req->cryptlen,
 297                                          crypto_aead_authsize(aead), 1);
 298         aead_request_complete(req, err);
 299 }
 300
 301 static inline int crypto_ccm_check_iv(const u8 *iv)
 302 {
 303         /* 2 <= L <= 8, so 1 <= L' <= 7. */
 304         if (1 > iv[0] || iv[0] > 7)
 305                 return -EINVAL;
 306
 307         return 0;
 308 }
 309
 310 static int crypto_ccm_init_crypt(struct aead_request *req, u8 *tag)
 311 {
 312         struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
 313         struct scatterlist *sg;
 314         u8 *iv = req->iv;
 315         int err;
 316
 317         err = crypto_ccm_check_iv(iv);
 318         if (err)
 319                 return err;
 320
 321         pctx->flags = aead_request_flags(req);
 322
 323          /* Note: rfc 3610 and NIST 800-38C require counter of
 324          * zero to encrypt auth tag.
 325          */
 326         memset(iv + 15 - iv[0], 0, iv[0] + 1);
 327
 328         sg_init_table(pctx->src, 3);
 329         sg_set_buf(pctx->src, tag, 16);
 330         sg = scatterwalk_ffwd(pctx->src + 1, req->src, req->assoclen);
 331         if (sg != pctx->src + 1)
 332                 sg_chain(pctx->src, 2, sg);
 333
 334         if (req->src != req->dst) {
 335                 sg_init_table(pctx->dst, 3);
 336                 sg_set_buf(pctx->dst, tag, 16);
 337                 sg = scatterwalk_ffwd(pctx->dst + 1, req->dst, req->assoclen);
 338                 if (sg != pctx->dst + 1)
 339                         sg_chain(pctx->dst, 2, sg);
 340         }
 341
 342         return 0;
 343 }
 344
 345 static int crypto_ccm_encrypt(struct aead_request *req)
 346 {
 347         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 348         struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
 349         struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
 350         struct skcipher_request *skreq = &pctx->skreq;
 351         struct scatterlist *dst;
 352         unsigned int cryptlen = req->cryptlen;
 353         u8 *odata = pctx->odata;
 354         u8 *iv = req->iv;
 355         int err;
 356
 357         err = crypto_ccm_init_crypt(req, odata);
 358         if (err)
 359                 return err;
 360
 361         err = crypto_ccm_auth(req, sg_next(pctx->src), cryptlen);
 362         if (err)
 363                 return err;
 364
 365         dst = pctx->src;
 366         if (req->src != req->dst)
 367                 dst = pctx->dst;
 368
 369         skcipher_request_set_tfm(skreq, ctx->ctr);
 370         skcipher_request_set_callback(skreq, pctx->flags,
 371                                       crypto_ccm_encrypt_done, req);
 372         skcipher_request_set_crypt(skreq, pctx->src, dst, cryptlen + 16, iv);
 373         err = crypto_skcipher_encrypt(skreq);
 374         if (err)
 375                 return err;
 376
 377         /* copy authtag to end of dst */
 378         scatterwalk_map_and_copy(odata, sg_next(dst), cryptlen,
 379                                  crypto_aead_authsize(aead), 1);
 380         return err;
 381 }
 382
 383 static void crypto_ccm_decrypt_done(struct crypto_async_request *areq,
 384                                    int err)
 385 {
 386         struct aead_request *req = areq->data;
 387         struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
 388         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 389         unsigned int authsize = crypto_aead_authsize(aead);
 390         unsigned int cryptlen = req->cryptlen - authsize;
 391         struct scatterlist *dst;
 392
 393         pctx->flags = 0;
 394
 395         dst = sg_next(req->src == req->dst ? pctx->src : pctx->dst);
 396
 397         if (!err) {
 398                 err = crypto_ccm_auth(req, dst, cryptlen);
 399                 if (!err && crypto_memneq(pctx->auth_tag, pctx->odata, authsize))
 400                         err = -EBADMSG;
 401         }
 402         aead_request_complete(req, err);
 403 }
 404
 405 static int crypto_ccm_decrypt(struct aead_request *req)
 406 {
 407         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 408         struct crypto_ccm_ctx *ctx = crypto_aead_ctx(aead);
 409         struct crypto_ccm_req_priv_ctx *pctx = crypto_ccm_reqctx(req);
 410         struct skcipher_request *skreq = &pctx->skreq;
 411         struct scatterlist *dst;
 412         unsigned int authsize = crypto_aead_authsize(aead);
 413         unsigned int cryptlen = req->cryptlen;
 414         u8 *authtag = pctx->auth_tag;
 415         u8 *odata = pctx->odata;
 416         u8 *iv = pctx->idata;
 417         int err;
 418
 419         cryptlen -= authsize;
 420
 421         err = crypto_ccm_init_crypt(req, authtag);
 422         if (err)
 423                 return err;
 424
 425         scatterwalk_map_and_copy(authtag, sg_next(pctx->src), cryptlen,
 426                                  authsize, 0);
 427
 428         dst = pctx->src;
 429         if (req->src != req->dst)
 430                 dst = pctx->dst;
 431
 432         memcpy(iv, req->iv, 16);
 433
 434         skcipher_request_set_tfm(skreq, ctx->ctr);
 435         skcipher_request_set_callback(skreq, pctx->flags,
 436                                       crypto_ccm_decrypt_done, req);
 437         skcipher_request_set_crypt(skreq, pctx->src, dst, cryptlen + 16, iv);
 438         err = crypto_skcipher_decrypt(skreq);
 439         if (err)
 440                 return err;
 441
 442         err = crypto_ccm_auth(req, sg_next(dst), cryptlen);
 443         if (err)
 444                 return err;
 445
 446         /* verify */
 447         if (crypto_memneq(authtag, odata, authsize))
 448                 return -EBADMSG;
 449
 450         return err;
 451 }
 452
 453 static int crypto_ccm_init_tfm(struct crypto_aead *tfm)
 454 {
 455         struct aead_instance *inst = aead_alg_instance(tfm);
 456         struct ccm_instance_ctx *ictx = aead_instance_ctx(inst);
 457         struct crypto_ccm_ctx *ctx = crypto_aead_ctx(tfm);
 458         struct crypto_cipher *cipher;
 459         struct crypto_skcipher *ctr;
 460         unsigned long align;
 461         int err;
 462
 463         cipher = crypto_spawn_cipher(&ictx->cipher);
 464         if (IS_ERR(cipher))
 465                 return PTR_ERR(cipher);
 466
 467         ctr = crypto_spawn_skcipher2(&ictx->ctr);
 468         err = PTR_ERR(ctr);
 469         if (IS_ERR(ctr))
 470                 goto err_free_cipher;
 471
 472         ctx->cipher = cipher;
 473         ctx->ctr = ctr;
 474
 475         align = crypto_aead_alignmask(tfm);
 476         align &= ~(crypto_tfm_ctx_alignment() - 1);
 477         crypto_aead_set_reqsize(
 478                 tfm,
 479                 align + sizeof(struct crypto_ccm_req_priv_ctx) +
 480                 crypto_skcipher_reqsize(ctr));
 481
 482         return 0;
 483
 484 err_free_cipher:
 485         crypto_free_cipher(cipher);
 486         return err;
 487 }
 488
 489 static void crypto_ccm_exit_tfm(struct crypto_aead *tfm)
 490 {
 491         struct crypto_ccm_ctx *ctx = crypto_aead_ctx(tfm);
 492
 493         crypto_free_cipher(ctx->cipher);
 494         crypto_free_skcipher(ctx->ctr);
 495 }
 496
 497 static void crypto_ccm_free(struct aead_instance *inst)
 498 {
 499         struct ccm_instance_ctx *ctx = aead_instance_ctx(inst);
 500
 501         crypto_drop_spawn(&ctx->cipher);
 502         crypto_drop_skcipher(&ctx->ctr);
 503         kfree(inst);
 504 }
 505
 506 static int crypto_ccm_create_common(struct crypto_template *tmpl,
 507                                     struct rtattr **tb,
 508                                     const char *full_name,
 509                                     const char *ctr_name,
 510                                     const char *cipher_name)
 511 {
 512         struct crypto_attr_type *algt;
 513         struct aead_instance *inst;
 514         struct skcipher_alg *ctr;
 515         struct crypto_alg *cipher;
 516         struct ccm_instance_ctx *ictx;
 517         int err;
 518
 519         algt = crypto_get_attr_type(tb);
 520         if (IS_ERR(algt))
 521                 return PTR_ERR(algt);
 522
 523         if ((algt->type ^ CRYPTO_ALG_TYPE_AEAD) & algt->mask)
 524                 return -EINVAL;
 525
 526         cipher = crypto_alg_mod_lookup(cipher_name,  CRYPTO_ALG_TYPE_CIPHER,
 527                                        CRYPTO_ALG_TYPE_MASK);
 528         if (IS_ERR(cipher))
 529                 return PTR_ERR(cipher);
 530
 531         err = -EINVAL;
 532         if (cipher->cra_blocksize != 16)
 533                 goto out_put_cipher;
 534
 535         inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL);
 536         err = -ENOMEM;
 537         if (!inst)
 538                 goto out_put_cipher;
 539
 540         ictx = aead_instance_ctx(inst);
 541
 542         err = crypto_init_spawn(&ictx->cipher, cipher,
 543                                 aead_crypto_instance(inst),
 544                                 CRYPTO_ALG_TYPE_MASK);
 545         if (err)
 546                 goto err_free_inst;
 547
 548         crypto_set_skcipher_spawn(&ictx->ctr, aead_crypto_instance(inst));
 549         err = crypto_grab_skcipher2(&ictx->ctr, ctr_name, 0,
 550                                     crypto_requires_sync(algt->type,
 551                                                          algt->mask));
 552         if (err)
 553                 goto err_drop_cipher;
 554
 555         ctr = crypto_spawn_skcipher_alg(&ictx->ctr);
 556
 557         /* Not a stream cipher? */
 558         err = -EINVAL;
 559         if (ctr->base.cra_blocksize != 1)
 560                 goto err_drop_ctr;
 561
 562         /* We want the real thing! */
 563         if (crypto_skcipher_alg_ivsize(ctr) != 16)
 564                 goto err_drop_ctr;
 565
 566         err = -ENAMETOOLONG;
 567         if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
 568                      "ccm_base(%s,%s)", ctr->base.cra_driver_name,
 569                      cipher->cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
 570                 goto err_drop_ctr;
 571
 572         memcpy(inst->alg.base.cra_name, full_name, CRYPTO_MAX_ALG_NAME);
 573
 574         inst->alg.base.cra_flags = ctr->base.cra_flags & CRYPTO_ALG_ASYNC;
 575         inst->alg.base.cra_priority = (cipher->cra_priority +
 576                                        ctr->base.cra_priority) / 2;
 577         inst->alg.base.cra_blocksize = 1;
 578         inst->alg.base.cra_alignmask = cipher->cra_alignmask |
 579                                        ctr->base.cra_alignmask |
 580                                        (__alignof__(u32) - 1);
 581         inst->alg.ivsize = 16;
 582         inst->alg.chunksize = crypto_skcipher_alg_chunksize(ctr);
 583         inst->alg.maxauthsize = 16;
 584         inst->alg.base.cra_ctxsize = sizeof(struct crypto_ccm_ctx);
 585         inst->alg.init = crypto_ccm_init_tfm;
 586         inst->alg.exit = crypto_ccm_exit_tfm;
 587         inst->alg.setkey = crypto_ccm_setkey;
 588         inst->alg.setauthsize = crypto_ccm_setauthsize;
 589         inst->alg.encrypt = crypto_ccm_encrypt;
 590         inst->alg.decrypt = crypto_ccm_decrypt;
 591
 592         inst->free = crypto_ccm_free;
 593
 594         err = aead_register_instance(tmpl, inst);
 595         if (err)
 596                 goto err_drop_ctr;
 597
 598 out_put_cipher:
 599         crypto_mod_put(cipher);
 600         return err;
 601
 602 err_drop_ctr:
 603         crypto_drop_skcipher(&ictx->ctr);
 604 err_drop_cipher:
 605         crypto_drop_spawn(&ictx->cipher);
 606 err_free_inst:
 607         kfree(inst);
 608         goto out_put_cipher;
 609 }
 610
 611 static int crypto_ccm_create(struct crypto_template *tmpl, struct rtattr **tb)
 612 {
 613         const char *cipher_name;
 614         char ctr_name[CRYPTO_MAX_ALG_NAME];
 615         char full_name[CRYPTO_MAX_ALG_NAME];
 616
 617         cipher_name = crypto_attr_alg_name(tb[1]);
 618         if (IS_ERR(cipher_name))
 619                 return PTR_ERR(cipher_name);
 620
 621         if (snprintf(ctr_name, CRYPTO_MAX_ALG_NAME, "ctr(%s)",
 622                      cipher_name) >= CRYPTO_MAX_ALG_NAME)
 623                 return -ENAMETOOLONG;
 624
 625         if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "ccm(%s)", cipher_name) >=
 626             CRYPTO_MAX_ALG_NAME)
 627                 return -ENAMETOOLONG;
 628
 629         return crypto_ccm_create_common(tmpl, tb, full_name, ctr_name,
 630                                         cipher_name);
 631 }
 632
 633 static struct crypto_template crypto_ccm_tmpl = {
 634         .name = "ccm",
 635         .create = crypto_ccm_create,
 636         .module = THIS_MODULE,
 637 };
 638
 639 static int crypto_ccm_base_create(struct crypto_template *tmpl,
 640                                   struct rtattr **tb)
 641 {
 642         const char *ctr_name;
 643         const char *cipher_name;
 644         char full_name[CRYPTO_MAX_ALG_NAME];
 645
 646         ctr_name = crypto_attr_alg_name(tb[1]);
 647         if (IS_ERR(ctr_name))
 648                 return PTR_ERR(ctr_name);
 649
 650         cipher_name = crypto_attr_alg_name(tb[2]);
 651         if (IS_ERR(cipher_name))
 652                 return PTR_ERR(cipher_name);
 653
 654         if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "ccm_base(%s,%s)",
 655                      ctr_name, cipher_name) >= CRYPTO_MAX_ALG_NAME)
 656                 return -ENAMETOOLONG;
 657
 658         return crypto_ccm_create_common(tmpl, tb, full_name, ctr_name,
 659                                         cipher_name);
 660 }
 661
 662 static struct crypto_template crypto_ccm_base_tmpl = {
 663         .name = "ccm_base",
 664         .create = crypto_ccm_base_create,
 665         .module = THIS_MODULE,
 666 };
 667
 668 static int crypto_rfc4309_setkey(struct crypto_aead *parent, const u8 *key,
 669                                  unsigned int keylen)
 670 {
 671         struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(parent);
 672         struct crypto_aead *child = ctx->child;
 673         int err;
 674
 675         if (keylen < 3)
 676                 return -EINVAL;
 677
 678         keylen -= 3;
 679         memcpy(ctx->nonce, key + keylen, 3);
 680
 681         crypto_aead_clear_flags(child, CRYPTO_TFM_REQ_MASK);
 682         crypto_aead_set_flags(child, crypto_aead_get_flags(parent) &
 683                                      CRYPTO_TFM_REQ_MASK);
 684         err = crypto_aead_setkey(child, key, keylen);
 685         crypto_aead_set_flags(parent, crypto_aead_get_flags(child) &
 686                                       CRYPTO_TFM_RES_MASK);
 687
 688         return err;
 689 }
 690
 691 static int crypto_rfc4309_setauthsize(struct crypto_aead *parent,
 692                                       unsigned int authsize)
 693 {
 694         struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(parent);
 695
 696         switch (authsize) {
 697         case 8:
 698         case 12:
 699         case 16:
 700                 break;
 701         default:
 702                 return -EINVAL;
 703         }
 704
 705         return crypto_aead_setauthsize(ctx->child, authsize);
 706 }
 707
 708 static struct aead_request *crypto_rfc4309_crypt(struct aead_request *req)
 709 {
 710         struct crypto_rfc4309_req_ctx *rctx = aead_request_ctx(req);
 711         struct aead_request *subreq = &rctx->subreq;
 712         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 713         struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(aead);
 714         struct crypto_aead *child = ctx->child;
 715         struct scatterlist *sg;
 716         u8 *iv = PTR_ALIGN((u8 *)(subreq + 1) + crypto_aead_reqsize(child),
 717                            crypto_aead_alignmask(child) + 1);
 718
 719         /* L' */
 720         iv[0] = 3;
 721
 722         memcpy(iv + 1, ctx->nonce, 3);
 723         memcpy(iv + 4, req->iv, 8);
 724
 725         scatterwalk_map_and_copy(iv + 16, req->src, 0, req->assoclen - 8, 0);
 726
 727         sg_init_table(rctx->src, 3);
 728         sg_set_buf(rctx->src, iv + 16, req->assoclen - 8);
 729         sg = scatterwalk_ffwd(rctx->src + 1, req->src, req->assoclen);
 730         if (sg != rctx->src + 1)
 731                 sg_chain(rctx->src, 2, sg);
 732
 733         if (req->src != req->dst) {
 734                 sg_init_table(rctx->dst, 3);
 735                 sg_set_buf(rctx->dst, iv + 16, req->assoclen - 8);
 736                 sg = scatterwalk_ffwd(rctx->dst + 1, req->dst, req->assoclen);
 737                 if (sg != rctx->dst + 1)
 738                         sg_chain(rctx->dst, 2, sg);
 739         }
 740
 741         aead_request_set_tfm(subreq, child);
 742         aead_request_set_callback(subreq, req->base.flags, req->base.complete,
 743                                   req->base.data);
 744         aead_request_set_crypt(subreq, rctx->src,
 745                                req->src == req->dst ? rctx->src : rctx->dst,
 746                                req->cryptlen, iv);
 747         aead_request_set_ad(subreq, req->assoclen - 8);
 748
 749         return subreq;
 750 }
 751
 752 static int crypto_rfc4309_encrypt(struct aead_request *req)
 753 {
 754         if (req->assoclen != 16 && req->assoclen != 20)
 755                 return -EINVAL;
 756
 757         req = crypto_rfc4309_crypt(req);
 758
 759         return crypto_aead_encrypt(req);
 760 }
 761
 762 static int crypto_rfc4309_decrypt(struct aead_request *req)
 763 {
 764         if (req->assoclen != 16 && req->assoclen != 20)
 765                 return -EINVAL;
 766
 767         req = crypto_rfc4309_crypt(req);
 768
 769         return crypto_aead_decrypt(req);
 770 }
 771
 772 static int crypto_rfc4309_init_tfm(struct crypto_aead *tfm)
 773 {
 774         struct aead_instance *inst = aead_alg_instance(tfm);
 775         struct crypto_aead_spawn *spawn = aead_instance_ctx(inst);
 776         struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(tfm);
 777         struct crypto_aead *aead;
 778         unsigned long align;
 779
 780         aead = crypto_spawn_aead(spawn);
 781         if (IS_ERR(aead))
 782                 return PTR_ERR(aead);
 783
 784         ctx->child = aead;
 785
 786         align = crypto_aead_alignmask(aead);
 787         align &= ~(crypto_tfm_ctx_alignment() - 1);
 788         crypto_aead_set_reqsize(
 789                 tfm,
 790                 sizeof(struct crypto_rfc4309_req_ctx) +
 791                 ALIGN(crypto_aead_reqsize(aead), crypto_tfm_ctx_alignment()) +
 792                 align + 32);
 793
 794         return 0;
 795 }
 796
 797 static void crypto_rfc4309_exit_tfm(struct crypto_aead *tfm)
 798 {
 799         struct crypto_rfc4309_ctx *ctx = crypto_aead_ctx(tfm);
 800
 801         crypto_free_aead(ctx->child);
 802 }
 803
 804 static void crypto_rfc4309_free(struct aead_instance *inst)
 805 {
 806         crypto_drop_aead(aead_instance_ctx(inst));
 807         kfree(inst);
 808 }
 809
 810 static int crypto_rfc4309_create(struct crypto_template *tmpl,
 811                                  struct rtattr **tb)
 812 {
 813         struct crypto_attr_type *algt;
 814         struct aead_instance *inst;
 815         struct crypto_aead_spawn *spawn;
 816         struct aead_alg *alg;
 817         const char *ccm_name;
 818         int err;
 819
 820         algt = crypto_get_attr_type(tb);
 821         if (IS_ERR(algt))
 822                 return PTR_ERR(algt);
 823
 824         if ((algt->type ^ CRYPTO_ALG_TYPE_AEAD) & algt->mask)
 825                 return -EINVAL;
 826
 827         ccm_name = crypto_attr_alg_name(tb[1]);
 828         if (IS_ERR(ccm_name))
 829                 return PTR_ERR(ccm_name);
 830
 831         inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
 832         if (!inst)
 833                 return -ENOMEM;
 834
 835         spawn = aead_instance_ctx(inst);
 836         crypto_set_aead_spawn(spawn, aead_crypto_instance(inst));
 837         err = crypto_grab_aead(spawn, ccm_name, 0,
 838                                crypto_requires_sync(algt->type, algt->mask));
 839         if (err)
 840                 goto out_free_inst;
 841
 842         alg = crypto_spawn_aead_alg(spawn);
 843
 844         err = -EINVAL;
 845
 846         /* We only support 16-byte blocks. */
 847         if (crypto_aead_alg_ivsize(alg) != 16)
 848                 goto out_drop_alg;
 849
 850         /* Not a stream cipher? */
 851         if (alg->base.cra_blocksize != 1)
 852                 goto out_drop_alg;
 853
 854         err = -ENAMETOOLONG;
 855         if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
 856                      "rfc4309(%s)", alg->base.cra_name) >=
 857             CRYPTO_MAX_ALG_NAME ||
 858             snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
 859                      "rfc4309(%s)", alg->base.cra_driver_name) >=
 860             CRYPTO_MAX_ALG_NAME)
 861                 goto out_drop_alg;
 862
 863         inst->alg.base.cra_flags = alg->base.cra_flags & CRYPTO_ALG_ASYNC;
 864         inst->alg.base.cra_priority = alg->base.cra_priority;
 865         inst->alg.base.cra_blocksize = 1;
 866         inst->alg.base.cra_alignmask = alg->base.cra_alignmask;
 867
 868         inst->alg.ivsize = 8;
 869         inst->alg.chunksize = crypto_aead_alg_chunksize(alg);
 870         inst->alg.maxauthsize = 16;
 871
 872         inst->alg.base.cra_ctxsize = sizeof(struct crypto_rfc4309_ctx);
 873
 874         inst->alg.init = crypto_rfc4309_init_tfm;
 875         inst->alg.exit = crypto_rfc4309_exit_tfm;
 876
 877         inst->alg.setkey = crypto_rfc4309_setkey;
 878         inst->alg.setauthsize = crypto_rfc4309_setauthsize;
 879         inst->alg.encrypt = crypto_rfc4309_encrypt;
 880         inst->alg.decrypt = crypto_rfc4309_decrypt;
 881
 882         inst->free = crypto_rfc4309_free;
 883
 884         err = aead_register_instance(tmpl, inst);
 885         if (err)
 886                 goto out_drop_alg;
 887
 888 out:
 889         return err;
 890
 891 out_drop_alg:
 892         crypto_drop_aead(spawn);
 893 out_free_inst:
 894         kfree(inst);
 895         goto out;
 896 }
 897
 898 static struct crypto_template crypto_rfc4309_tmpl = {
 899         .name = "rfc4309",
 900         .create = crypto_rfc4309_create,
 901         .module = THIS_MODULE,
 902 };
 903
 904 static int __init crypto_ccm_module_init(void)
 905 {
 906         int err;
 907
 908         err = crypto_register_template(&crypto_ccm_base_tmpl);
 909         if (err)
 910                 goto out;
 911
 912         err = crypto_register_template(&crypto_ccm_tmpl);
 913         if (err)
 914                 goto out_undo_base;
 915
 916         err = crypto_register_template(&crypto_rfc4309_tmpl);
 917         if (err)
 918                 goto out_undo_ccm;
 919
 920 out:
 921         return err;
 922
 923 out_undo_ccm:
 924         crypto_unregister_template(&crypto_ccm_tmpl);
 925 out_undo_base:
 926         crypto_unregister_template(&crypto_ccm_base_tmpl);
 927         goto out;
 928 }
 929
 930 static void __exit crypto_ccm_module_exit(void)
 931 {
 932         crypto_unregister_template(&crypto_rfc4309_tmpl);
 933         crypto_unregister_template(&crypto_ccm_tmpl);
 934         crypto_unregister_template(&crypto_ccm_base_tmpl);
 935 }
 936
 937 module_init(crypto_ccm_module_init);
 938 module_exit(crypto_ccm_module_exit);
 939
 940 MODULE_LICENSE("GPL");
 941 MODULE_DESCRIPTION("Counter with CBC MAC");
 942 MODULE_ALIAS_CRYPTO("ccm_base");
 943 MODULE_ALIAS_CRYPTO("rfc4309");
 944 MODULE_ALIAS_CRYPTO("ccm");