crypto/aead.c

   1 /*
   2  * AEAD: Authenticated Encryption with Associated Data
   3  *
   4  * This file provides API support for AEAD algorithms.
   5  *
   6  * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the Free
  10  * Software Foundation; either version 2 of the License, or (at your option)
  11  * any later version.
  12  *
  13  */
  14
  15 #include <crypto/internal/geniv.h>
  16 #include <crypto/scatterwalk.h>
  17 #include <linux/err.h>
  18 #include <linux/init.h>
  19 #include <linux/kernel.h>
  20 #include <linux/module.h>
  21 #include <linux/rtnetlink.h>
  22 #include <linux/sched.h>
  23 #include <linux/slab.h>
  24 #include <linux/seq_file.h>
  25 #include <linux/cryptouser.h>
  26 #include <net/netlink.h>
  27
  28 #include "internal.h"
  29
  30 struct compat_request_ctx {
  31         struct scatterlist src[2];
  32         struct scatterlist dst[2];
  33         struct scatterlist ivbuf[2];
  34         struct scatterlist *ivsg;
  35         struct aead_givcrypt_request subreq;
  36 };
  37
  38 static int aead_null_givencrypt(struct aead_givcrypt_request *req);
  39 static int aead_null_givdecrypt(struct aead_givcrypt_request *req);
  40
  41 static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key,
  42                             unsigned int keylen)
  43 {
  44         unsigned long alignmask = crypto_aead_alignmask(tfm);
  45         int ret;
  46         u8 *buffer, *alignbuffer;
  47         unsigned long absize;
  48
  49         absize = keylen + alignmask;
  50         buffer = kmalloc(absize, GFP_ATOMIC);
  51         if (!buffer)
  52                 return -ENOMEM;
  53
  54         alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
  55         memcpy(alignbuffer, key, keylen);
  56         ret = tfm->setkey(tfm, alignbuffer, keylen);
  57         memset(alignbuffer, 0, keylen);
  58         kfree(buffer);
  59         return ret;
  60 }
  61
  62 int crypto_aead_setkey(struct crypto_aead *tfm,
  63                        const u8 *key, unsigned int keylen)
  64 {
  65         unsigned long alignmask = crypto_aead_alignmask(tfm);
  66
  67         tfm = tfm->child;
  68
  69         if ((unsigned long)key & alignmask)
  70                 return setkey_unaligned(tfm, key, keylen);
  71
  72         return tfm->setkey(tfm, key, keylen);
  73 }
  74 EXPORT_SYMBOL_GPL(crypto_aead_setkey);
  75
  76 int crypto_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
  77 {
  78         int err;
  79
  80         if (authsize > crypto_aead_maxauthsize(tfm))
  81                 return -EINVAL;
  82
  83         if (tfm->setauthsize) {
  84                 err = tfm->setauthsize(tfm->child, authsize);
  85                 if (err)
  86                         return err;
  87         }
  88
  89         tfm->child->authsize = authsize;
  90         tfm->authsize = authsize;
  91         return 0;
  92 }
  93 EXPORT_SYMBOL_GPL(crypto_aead_setauthsize);
  94
  95 struct aead_old_request {
  96         struct scatterlist srcbuf[2];
  97         struct scatterlist dstbuf[2];
  98         struct aead_request subreq;
  99 };
 100
 101 unsigned int crypto_aead_reqsize(struct crypto_aead *tfm)
 102 {
 103         return tfm->reqsize + sizeof(struct aead_old_request);
 104 }
 105 EXPORT_SYMBOL_GPL(crypto_aead_reqsize);
 106
 107 static int old_crypt(struct aead_request *req,
 108                      int (*crypt)(struct aead_request *req))
 109 {
 110         struct aead_old_request *nreq = aead_request_ctx(req);
 111         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 112         struct scatterlist *src, *dst;
 113
 114         if (req->old)
 115                 return crypt(req);
 116
 117         src = scatterwalk_ffwd(nreq->srcbuf, req->src, req->assoclen);
 118         dst = req->src == req->dst ?
 119               src : scatterwalk_ffwd(nreq->dstbuf, req->dst, req->assoclen);
 120
 121         aead_request_set_tfm(&nreq->subreq, aead);
 122         aead_request_set_callback(&nreq->subreq, aead_request_flags(req),
 123                                   req->base.complete, req->base.data);
 124         aead_request_set_crypt(&nreq->subreq, src, dst, req->cryptlen,
 125                                req->iv);
 126         aead_request_set_assoc(&nreq->subreq, req->src, req->assoclen);
 127
 128         return crypt(&nreq->subreq);
 129 }
 130
 131 static int old_encrypt(struct aead_request *req)
 132 {
 133         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 134         struct old_aead_alg *alg = crypto_old_aead_alg(aead);
 135
 136         return old_crypt(req, alg->encrypt);
 137 }
 138
 139 static int old_decrypt(struct aead_request *req)
 140 {
 141         struct crypto_aead *aead = crypto_aead_reqtfm(req);
 142         struct old_aead_alg *alg = crypto_old_aead_alg(aead);
 143
 144         return old_crypt(req, alg->decrypt);
 145 }
 146
 147 static int no_givcrypt(struct aead_givcrypt_request *req)
 148 {
 149         return -ENOSYS;
 150 }
 151
 152 static int crypto_old_aead_init_tfm(struct crypto_tfm *tfm)
 153 {
 154         struct old_aead_alg *alg = &tfm->__crt_alg->cra_aead;
 155         struct crypto_aead *crt = __crypto_aead_cast(tfm);
 156
 157         if (max(alg->maxauthsize, alg->ivsize) > PAGE_SIZE / 8)
 158                 return -EINVAL;
 159
 160         crt->setkey = alg->setkey;
 161         crt->setauthsize = alg->setauthsize;
 162         crt->encrypt = old_encrypt;
 163         crt->decrypt = old_decrypt;
 164         if (alg->ivsize) {
 165                 crt->givencrypt = alg->givencrypt ?: no_givcrypt;
 166                 crt->givdecrypt = alg->givdecrypt ?: no_givcrypt;
 167         } else {
 168                 crt->givencrypt = aead_null_givencrypt;
 169                 crt->givdecrypt = aead_null_givdecrypt;
 170         }
 171         crt->child = __crypto_aead_cast(tfm);
 172         crt->authsize = alg->maxauthsize;
 173
 174         return 0;
 175 }
 176
 177 static void crypto_aead_exit_tfm(struct crypto_tfm *tfm)
 178 {
 179         struct crypto_aead *aead = __crypto_aead_cast(tfm);
 180         struct aead_alg *alg = crypto_aead_alg(aead);
 181
 182         alg->exit(aead);
 183 }
 184
 185 static int crypto_aead_init_tfm(struct crypto_tfm *tfm)
 186 {
 187         struct crypto_aead *aead = __crypto_aead_cast(tfm);
 188         struct aead_alg *alg = crypto_aead_alg(aead);
 189
 190         if (crypto_old_aead_alg(aead)->encrypt)
 191                 return crypto_old_aead_init_tfm(tfm);
 192
 193         aead->setkey = alg->setkey;
 194         aead->setauthsize = alg->setauthsize;
 195         aead->encrypt = alg->encrypt;
 196         aead->decrypt = alg->decrypt;
 197         aead->child = __crypto_aead_cast(tfm);
 198         aead->authsize = alg->maxauthsize;
 199
 200         if (alg->exit)
 201                 aead->base.exit = crypto_aead_exit_tfm;
 202
 203         if (alg->init)
 204                 return alg->init(aead);
 205
 206         return 0;
 207 }
 208
 209 #ifdef CONFIG_NET
 210 static int crypto_old_aead_report(struct sk_buff *skb, struct crypto_alg *alg)
 211 {
 212         struct crypto_report_aead raead;
 213         struct old_aead_alg *aead = &alg->cra_aead;
 214
 215         strncpy(raead.type, "aead", sizeof(raead.type));
 216         strncpy(raead.geniv, aead->geniv ?: "<built-in>", sizeof(raead.geniv));
 217
 218         raead.blocksize = alg->cra_blocksize;
 219         raead.maxauthsize = aead->maxauthsize;
 220         raead.ivsize = aead->ivsize;
 221
 222         if (nla_put(skb, CRYPTOCFGA_REPORT_AEAD,
 223                     sizeof(struct crypto_report_aead), &raead))
 224                 goto nla_put_failure;
 225         return 0;
 226
 227 nla_put_failure:
 228         return -EMSGSIZE;
 229 }
 230 #else
 231 static int crypto_old_aead_report(struct sk_buff *skb, struct crypto_alg *alg)
 232 {
 233         return -ENOSYS;
 234 }
 235 #endif
 236
 237 static void crypto_old_aead_show(struct seq_file *m, struct crypto_alg *alg)
 238         __attribute__ ((unused));
 239 static void crypto_old_aead_show(struct seq_file *m, struct crypto_alg *alg)
 240 {
 241         struct old_aead_alg *aead = &alg->cra_aead;
 242
 243         seq_printf(m, "type         : aead\n");
 244         seq_printf(m, "async        : %s\n", alg->cra_flags & CRYPTO_ALG_ASYNC ?
 245                                              "yes" : "no");
 246         seq_printf(m, "blocksize    : %u\n", alg->cra_blocksize);
 247         seq_printf(m, "ivsize       : %u\n", aead->ivsize);
 248         seq_printf(m, "maxauthsize  : %u\n", aead->maxauthsize);
 249         seq_printf(m, "geniv        : %s\n", aead->geniv ?: "<built-in>");
 250 }
 251
 252 const struct crypto_type crypto_aead_type = {
 253         .extsize = crypto_alg_extsize,
 254         .init_tfm = crypto_aead_init_tfm,
 255 #ifdef CONFIG_PROC_FS
 256         .show = crypto_old_aead_show,
 257 #endif
 258         .report = crypto_old_aead_report,
 259         .lookup = crypto_lookup_aead,
 260         .maskclear = ~(CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_GENIV),
 261         .maskset = CRYPTO_ALG_TYPE_MASK,
 262         .type = CRYPTO_ALG_TYPE_AEAD,
 263         .tfmsize = offsetof(struct crypto_aead, base),
 264 };
 265 EXPORT_SYMBOL_GPL(crypto_aead_type);
 266
 267 #ifdef CONFIG_NET
 268 static int crypto_aead_report(struct sk_buff *skb, struct crypto_alg *alg)
 269 {
 270         struct crypto_report_aead raead;
 271         struct aead_alg *aead = container_of(alg, struct aead_alg, base);
 272
 273         strncpy(raead.type, "aead", sizeof(raead.type));
 274         strncpy(raead.geniv, "<none>", sizeof(raead.geniv));
 275
 276         raead.blocksize = alg->cra_blocksize;
 277         raead.maxauthsize = aead->maxauthsize;
 278         raead.ivsize = aead->ivsize;
 279
 280         if (nla_put(skb, CRYPTOCFGA_REPORT_AEAD,
 281                     sizeof(struct crypto_report_aead), &raead))
 282                 goto nla_put_failure;
 283         return 0;
 284
 285 nla_put_failure:
 286         return -EMSGSIZE;
 287 }
 288 #else
 289 static int crypto_aead_report(struct sk_buff *skb, struct crypto_alg *alg)
 290 {
 291         return -ENOSYS;
 292 }
 293 #endif
 294
 295 static void crypto_aead_show(struct seq_file *m, struct crypto_alg *alg)
 296         __attribute__ ((unused));
 297 static void crypto_aead_show(struct seq_file *m, struct crypto_alg *alg)
 298 {
 299         struct aead_alg *aead = container_of(alg, struct aead_alg, base);
 300
 301         seq_printf(m, "type         : aead\n");
 302         seq_printf(m, "async        : %s\n", alg->cra_flags & CRYPTO_ALG_ASYNC ?
 303                                              "yes" : "no");
 304         seq_printf(m, "blocksize    : %u\n", alg->cra_blocksize);
 305         seq_printf(m, "ivsize       : %u\n", aead->ivsize);
 306         seq_printf(m, "maxauthsize  : %u\n", aead->maxauthsize);
 307         seq_printf(m, "geniv        : <none>\n");
 308 }
 309
 310 static const struct crypto_type crypto_new_aead_type = {
 311         .extsize = crypto_alg_extsize,
 312         .init_tfm = crypto_aead_init_tfm,
 313 #ifdef CONFIG_PROC_FS
 314         .show = crypto_aead_show,
 315 #endif
 316         .report = crypto_aead_report,
 317         .maskclear = ~CRYPTO_ALG_TYPE_MASK,
 318         .maskset = CRYPTO_ALG_TYPE_MASK,
 319         .type = CRYPTO_ALG_TYPE_AEAD,
 320         .tfmsize = offsetof(struct crypto_aead, base),
 321 };
 322
 323 static int aead_null_givencrypt(struct aead_givcrypt_request *req)
 324 {
 325         return crypto_aead_encrypt(&req->areq);
 326 }
 327
 328 static int aead_null_givdecrypt(struct aead_givcrypt_request *req)
 329 {
 330         return crypto_aead_decrypt(&req->areq);
 331 }
 332
 333 #ifdef CONFIG_NET
 334 static int crypto_nivaead_report(struct sk_buff *skb, struct crypto_alg *alg)
 335 {
 336         struct crypto_report_aead raead;
 337         struct old_aead_alg *aead = &alg->cra_aead;
 338
 339         strncpy(raead.type, "nivaead", sizeof(raead.type));
 340         strncpy(raead.geniv, aead->geniv, sizeof(raead.geniv));
 341
 342         raead.blocksize = alg->cra_blocksize;
 343         raead.maxauthsize = aead->maxauthsize;
 344         raead.ivsize = aead->ivsize;
 345
 346         if (nla_put(skb, CRYPTOCFGA_REPORT_AEAD,
 347                     sizeof(struct crypto_report_aead), &raead))
 348                 goto nla_put_failure;
 349         return 0;
 350
 351 nla_put_failure:
 352         return -EMSGSIZE;
 353 }
 354 #else
 355 static int crypto_nivaead_report(struct sk_buff *skb, struct crypto_alg *alg)
 356 {
 357         return -ENOSYS;
 358 }
 359 #endif
 360
 361
 362 static void crypto_nivaead_show(struct seq_file *m, struct crypto_alg *alg)
 363         __attribute__ ((unused));
 364 static void crypto_nivaead_show(struct seq_file *m, struct crypto_alg *alg)
 365 {
 366         struct old_aead_alg *aead = &alg->cra_aead;
 367
 368         seq_printf(m, "type         : nivaead\n");
 369         seq_printf(m, "async        : %s\n", alg->cra_flags & CRYPTO_ALG_ASYNC ?
 370                                              "yes" : "no");
 371         seq_printf(m, "blocksize    : %u\n", alg->cra_blocksize);
 372         seq_printf(m, "ivsize       : %u\n", aead->ivsize);
 373         seq_printf(m, "maxauthsize  : %u\n", aead->maxauthsize);
 374         seq_printf(m, "geniv        : %s\n", aead->geniv);
 375 }
 376
 377 const struct crypto_type crypto_nivaead_type = {
 378         .extsize = crypto_alg_extsize,
 379         .init_tfm = crypto_aead_init_tfm,
 380 #ifdef CONFIG_PROC_FS
 381         .show = crypto_nivaead_show,
 382 #endif
 383         .report = crypto_nivaead_report,
 384         .maskclear = ~(CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_GENIV),
 385         .maskset = CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_GENIV,
 386         .type = CRYPTO_ALG_TYPE_AEAD,
 387         .tfmsize = offsetof(struct crypto_aead, base),
 388 };
 389 EXPORT_SYMBOL_GPL(crypto_nivaead_type);
 390
 391 static int crypto_grab_nivaead(struct crypto_aead_spawn *spawn,
 392                                const char *name, u32 type, u32 mask)
 393 {
 394         spawn->base.frontend = &crypto_nivaead_type;
 395         return crypto_grab_spawn(&spawn->base, name, type, mask);
 396 }
 397
 398 static int aead_geniv_setkey(struct crypto_aead *tfm,
 399                              const u8 *key, unsigned int keylen)
 400 {
 401         struct aead_geniv_ctx *ctx = crypto_aead_ctx(tfm);
 402
 403         return crypto_aead_setkey(ctx->child, key, keylen);
 404 }
 405
 406 static int aead_geniv_setauthsize(struct crypto_aead *tfm,
 407                                   unsigned int authsize)
 408 {
 409         struct aead_geniv_ctx *ctx = crypto_aead_ctx(tfm);
 410
 411         return crypto_aead_setauthsize(ctx->child, authsize);
 412 }
 413
 414 static void compat_encrypt_complete2(struct aead_request *req, int err)
 415 {
 416         struct compat_request_ctx *rctx = aead_request_ctx(req);
 417         struct aead_givcrypt_request *subreq = &rctx->subreq;
 418         struct crypto_aead *geniv;
 419
 420         if (err == -EINPROGRESS)
 421                 return;
 422
 423         if (err)
 424                 goto out;
 425
 426         geniv = crypto_aead_reqtfm(req);
 427         scatterwalk_map_and_copy(subreq->giv, rctx->ivsg, 0,
 428                                  crypto_aead_ivsize(geniv), 1);
 429
 430 out:
 431         kzfree(subreq->giv);
 432 }
 433
 434 static void compat_encrypt_complete(struct crypto_async_request *base, int err)
 435 {
 436         struct aead_request *req = base->data;
 437
 438         compat_encrypt_complete2(req, err);
 439         aead_request_complete(req, err);
 440 }
 441
 442 static int compat_encrypt(struct aead_request *req)
 443 {
 444         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 445         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
 446         struct compat_request_ctx *rctx = aead_request_ctx(req);
 447         struct aead_givcrypt_request *subreq = &rctx->subreq;
 448         unsigned int ivsize = crypto_aead_ivsize(geniv);
 449         struct scatterlist *src, *dst;
 450         crypto_completion_t compl;
 451         void *data;
 452         u8 *info;
 453         __be64 seq;
 454         int err;
 455
 456         if (req->cryptlen < ivsize)
 457                 return -EINVAL;
 458
 459         compl = req->base.complete;
 460         data = req->base.data;
 461
 462         rctx->ivsg = scatterwalk_ffwd(rctx->ivbuf, req->dst, req->assoclen);
 463         info = PageHighMem(sg_page(rctx->ivsg)) ? NULL : sg_virt(rctx->ivsg);
 464
 465         if (!info) {
 466                 info = kmalloc(ivsize, req->base.flags &
 467                                        CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
 468                                                                   GFP_ATOMIC);
 469                 if (!info)
 470                         return -ENOMEM;
 471
 472                 compl = compat_encrypt_complete;
 473                 data = req;
 474         }
 475
 476         memcpy(&seq, req->iv + ivsize - sizeof(seq), sizeof(seq));
 477
 478         src = scatterwalk_ffwd(rctx->src, req->src, req->assoclen + ivsize);
 479         dst = req->src == req->dst ?
 480               src : scatterwalk_ffwd(rctx->dst, rctx->ivsg, ivsize);
 481
 482         aead_givcrypt_set_tfm(subreq, ctx->child);
 483         aead_givcrypt_set_callback(subreq, req->base.flags,
 484                                    req->base.complete, req->base.data);
 485         aead_givcrypt_set_crypt(subreq, src, dst,
 486                                 req->cryptlen - ivsize, req->iv);
 487         aead_givcrypt_set_assoc(subreq, req->src, req->assoclen);
 488         aead_givcrypt_set_giv(subreq, info, be64_to_cpu(seq));
 489
 490         err = crypto_aead_givencrypt(subreq);
 491         if (unlikely(PageHighMem(sg_page(rctx->ivsg))))
 492                 compat_encrypt_complete2(req, err);
 493         return err;
 494 }
 495
 496 static int compat_decrypt(struct aead_request *req)
 497 {
 498         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 499         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
 500         struct compat_request_ctx *rctx = aead_request_ctx(req);
 501         struct aead_request *subreq = &rctx->subreq.areq;
 502         unsigned int ivsize = crypto_aead_ivsize(geniv);
 503         struct scatterlist *src, *dst;
 504         crypto_completion_t compl;
 505         void *data;
 506
 507         if (req->cryptlen < ivsize)
 508                 return -EINVAL;
 509
 510         aead_request_set_tfm(subreq, ctx->child);
 511
 512         compl = req->base.complete;
 513         data = req->base.data;
 514
 515         src = scatterwalk_ffwd(rctx->src, req->src, req->assoclen + ivsize);
 516         dst = req->src == req->dst ?
 517               src : scatterwalk_ffwd(rctx->dst, req->dst,
 518                                      req->assoclen + ivsize);
 519
 520         aead_request_set_callback(subreq, req->base.flags, compl, data);
 521         aead_request_set_crypt(subreq, src, dst,
 522                                req->cryptlen - ivsize, req->iv);
 523         aead_request_set_assoc(subreq, req->src, req->assoclen);
 524
 525         scatterwalk_map_and_copy(req->iv, req->src, req->assoclen, ivsize, 0);
 526
 527         return crypto_aead_decrypt(subreq);
 528 }
 529
 530 static int compat_encrypt_first(struct aead_request *req)
 531 {
 532         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 533         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
 534         int err = 0;
 535
 536         spin_lock_bh(&ctx->lock);
 537         if (geniv->encrypt != compat_encrypt_first)
 538                 goto unlock;
 539
 540         geniv->encrypt = compat_encrypt;
 541
 542 unlock:
 543         spin_unlock_bh(&ctx->lock);
 544
 545         if (err)
 546                 return err;
 547
 548         return compat_encrypt(req);
 549 }
 550
 551 static int aead_geniv_init_compat(struct crypto_tfm *tfm)
 552 {
 553         struct crypto_aead *geniv = __crypto_aead_cast(tfm);
 554         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
 555         int err;
 556
 557         spin_lock_init(&ctx->lock);
 558
 559         crypto_aead_set_reqsize(geniv, sizeof(struct compat_request_ctx));
 560
 561         err = aead_geniv_init(tfm);
 562
 563         ctx->child = geniv->child;
 564         geniv->child = geniv;
 565
 566         return err;
 567 }
 568
 569 static void aead_geniv_exit_compat(struct crypto_tfm *tfm)
 570 {
 571         struct crypto_aead *geniv = __crypto_aead_cast(tfm);
 572         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
 573
 574         crypto_free_aead(ctx->child);
 575 }
 576
 577 struct aead_instance *aead_geniv_alloc(struct crypto_template *tmpl,
 578                                        struct rtattr **tb, u32 type, u32 mask)
 579 {
 580         const char *name;
 581         struct crypto_aead_spawn *spawn;
 582         struct crypto_attr_type *algt;
 583         struct aead_instance *inst;
 584         struct aead_alg *alg;
 585         unsigned int ivsize;
 586         unsigned int maxauthsize;
 587         int err;
 588
 589         algt = crypto_get_attr_type(tb);
 590         if (IS_ERR(algt))
 591                 return ERR_CAST(algt);
 592
 593         if ((algt->type ^ (CRYPTO_ALG_TYPE_AEAD | CRYPTO_ALG_GENIV)) &
 594             algt->mask)
 595                 return ERR_PTR(-EINVAL);
 596
 597         name = crypto_attr_alg_name(tb[1]);
 598         if (IS_ERR(name))
 599                 return ERR_CAST(name);
 600
 601         inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
 602         if (!inst)
 603                 return ERR_PTR(-ENOMEM);
 604
 605         spawn = aead_instance_ctx(inst);
 606
 607         /* Ignore async algorithms if necessary. */
 608         mask |= crypto_requires_sync(algt->type, algt->mask);
 609
 610         crypto_set_aead_spawn(spawn, aead_crypto_instance(inst));
 611         err = (algt->mask & CRYPTO_ALG_GENIV) ?
 612               crypto_grab_nivaead(spawn, name, type, mask) :
 613               crypto_grab_aead(spawn, name, type, mask);
 614         if (err)
 615                 goto err_free_inst;
 616
 617         alg = crypto_spawn_aead_alg(spawn);
 618
 619         ivsize = crypto_aead_alg_ivsize(alg);
 620         maxauthsize = crypto_aead_alg_maxauthsize(alg);
 621
 622         err = -EINVAL;
 623         if (ivsize < sizeof(u64))
 624                 goto err_drop_alg;
 625
 626         /*
 627          * This is only true if we're constructing an algorithm with its
 628          * default IV generator.  For the default generator we elide the
 629          * template name and double-check the IV generator.
 630          */
 631         if (algt->mask & CRYPTO_ALG_GENIV) {
 632                 if (!alg->base.cra_aead.encrypt)
 633                         goto err_drop_alg;
 634                 if (strcmp(tmpl->name, alg->base.cra_aead.geniv))
 635                         goto err_drop_alg;
 636
 637                 memcpy(inst->alg.base.cra_name, alg->base.cra_name,
 638                        CRYPTO_MAX_ALG_NAME);
 639                 memcpy(inst->alg.base.cra_driver_name,
 640                        alg->base.cra_driver_name, CRYPTO_MAX_ALG_NAME);
 641
 642                 inst->alg.base.cra_flags = CRYPTO_ALG_TYPE_AEAD |
 643                                            CRYPTO_ALG_GENIV;
 644                 inst->alg.base.cra_flags |= alg->base.cra_flags &
 645                                             CRYPTO_ALG_ASYNC;
 646                 inst->alg.base.cra_priority = alg->base.cra_priority;
 647                 inst->alg.base.cra_blocksize = alg->base.cra_blocksize;
 648                 inst->alg.base.cra_alignmask = alg->base.cra_alignmask;
 649                 inst->alg.base.cra_type = &crypto_aead_type;
 650
 651                 inst->alg.base.cra_aead.ivsize = ivsize;
 652                 inst->alg.base.cra_aead.maxauthsize = maxauthsize;
 653
 654                 inst->alg.base.cra_aead.setkey = alg->base.cra_aead.setkey;
 655                 inst->alg.base.cra_aead.setauthsize =
 656                         alg->base.cra_aead.setauthsize;
 657                 inst->alg.base.cra_aead.encrypt = alg->base.cra_aead.encrypt;
 658                 inst->alg.base.cra_aead.decrypt = alg->base.cra_aead.decrypt;
 659
 660                 goto out;
 661         }
 662
 663         err = -ENAMETOOLONG;
 664         if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
 665                      "%s(%s)", tmpl->name, alg->base.cra_name) >=
 666             CRYPTO_MAX_ALG_NAME)
 667                 goto err_drop_alg;
 668         if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
 669                      "%s(%s)", tmpl->name, alg->base.cra_driver_name) >=
 670             CRYPTO_MAX_ALG_NAME)
 671                 goto err_drop_alg;
 672
 673         inst->alg.base.cra_flags = alg->base.cra_flags & CRYPTO_ALG_ASYNC;
 674         inst->alg.base.cra_priority = alg->base.cra_priority;
 675         inst->alg.base.cra_blocksize = alg->base.cra_blocksize;
 676         inst->alg.base.cra_alignmask = alg->base.cra_alignmask;
 677         inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx);
 678
 679         inst->alg.setkey = aead_geniv_setkey;
 680         inst->alg.setauthsize = aead_geniv_setauthsize;
 681
 682         inst->alg.ivsize = ivsize;
 683         inst->alg.maxauthsize = maxauthsize;
 684
 685         inst->alg.encrypt = compat_encrypt_first;
 686         inst->alg.decrypt = compat_decrypt;
 687
 688         inst->alg.base.cra_init = aead_geniv_init_compat;
 689         inst->alg.base.cra_exit = aead_geniv_exit_compat;
 690
 691 out:
 692         return inst;
 693
 694 err_drop_alg:
 695         crypto_drop_aead(spawn);
 696 err_free_inst:
 697         kfree(inst);
 698         inst = ERR_PTR(err);
 699         goto out;
 700 }
 701 EXPORT_SYMBOL_GPL(aead_geniv_alloc);
 702
 703 void aead_geniv_free(struct aead_instance *inst)
 704 {
 705         crypto_drop_aead(aead_instance_ctx(inst));
 706         kfree(inst);
 707 }
 708 EXPORT_SYMBOL_GPL(aead_geniv_free);
 709
 710 int aead_geniv_init(struct crypto_tfm *tfm)
 711 {
 712         struct crypto_instance *inst = (void *)tfm->__crt_alg;
 713         struct crypto_aead *child;
 714         struct crypto_aead *aead;
 715
 716         aead = __crypto_aead_cast(tfm);
 717
 718         child = crypto_spawn_aead(crypto_instance_ctx(inst));
 719         if (IS_ERR(child))
 720                 return PTR_ERR(child);
 721
 722         aead->child = child;
 723         aead->reqsize += crypto_aead_reqsize(child);
 724
 725         return 0;
 726 }
 727 EXPORT_SYMBOL_GPL(aead_geniv_init);
 728
 729 void aead_geniv_exit(struct crypto_tfm *tfm)
 730 {
 731         crypto_free_aead(__crypto_aead_cast(tfm)->child);
 732 }
 733 EXPORT_SYMBOL_GPL(aead_geniv_exit);
 734
 735 static int crypto_nivaead_default(struct crypto_alg *alg, u32 type, u32 mask)
 736 {
 737         struct rtattr *tb[3];
 738         struct {
 739                 struct rtattr attr;
 740                 struct crypto_attr_type data;
 741         } ptype;
 742         struct {
 743                 struct rtattr attr;
 744                 struct crypto_attr_alg data;
 745         } palg;
 746         struct crypto_template *tmpl;
 747         struct crypto_instance *inst;
 748         struct crypto_alg *larval;
 749         const char *geniv;
 750         int err;
 751
 752         larval = crypto_larval_lookup(alg->cra_driver_name,
 753                                       CRYPTO_ALG_TYPE_AEAD | CRYPTO_ALG_GENIV,
 754                                       CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_GENIV);
 755         err = PTR_ERR(larval);
 756         if (IS_ERR(larval))
 757                 goto out;
 758
 759         err = -EAGAIN;
 760         if (!crypto_is_larval(larval))
 761                 goto drop_larval;
 762
 763         ptype.attr.rta_len = sizeof(ptype);
 764         ptype.attr.rta_type = CRYPTOA_TYPE;
 765         ptype.data.type = type | CRYPTO_ALG_GENIV;
 766         /* GENIV tells the template that we're making a default geniv. */
 767         ptype.data.mask = mask | CRYPTO_ALG_GENIV;
 768         tb[0] = &ptype.attr;
 769
 770         palg.attr.rta_len = sizeof(palg);
 771         palg.attr.rta_type = CRYPTOA_ALG;
 772         /* Must use the exact name to locate ourselves. */
 773         memcpy(palg.data.name, alg->cra_driver_name, CRYPTO_MAX_ALG_NAME);
 774         tb[1] = &palg.attr;
 775
 776         tb[2] = NULL;
 777
 778         geniv = alg->cra_aead.geniv;
 779
 780         tmpl = crypto_lookup_template(geniv);
 781         err = -ENOENT;
 782         if (!tmpl)
 783                 goto kill_larval;
 784
 785         if (tmpl->create) {
 786                 err = tmpl->create(tmpl, tb);
 787                 if (err)
 788                         goto put_tmpl;
 789                 goto ok;
 790         }
 791
 792         inst = tmpl->alloc(tb);
 793         err = PTR_ERR(inst);
 794         if (IS_ERR(inst))
 795                 goto put_tmpl;
 796
 797         err = crypto_register_instance(tmpl, inst);
 798         if (err) {
 799                 tmpl->free(inst);
 800                 goto put_tmpl;
 801         }
 802
 803 ok:
 804         /* Redo the lookup to use the instance we just registered. */
 805         err = -EAGAIN;
 806
 807 put_tmpl:
 808         crypto_tmpl_put(tmpl);
 809 kill_larval:
 810         crypto_larval_kill(larval);
 811 drop_larval:
 812         crypto_mod_put(larval);
 813 out:
 814         crypto_mod_put(alg);
 815         return err;
 816 }
 817
 818 struct crypto_alg *crypto_lookup_aead(const char *name, u32 type, u32 mask)
 819 {
 820         struct crypto_alg *alg;
 821
 822         alg = crypto_alg_mod_lookup(name, type, mask);
 823         if (IS_ERR(alg))
 824                 return alg;
 825
 826         if (alg->cra_type == &crypto_aead_type)
 827                 return alg;
 828
 829         if (!alg->cra_aead.ivsize)
 830                 return alg;
 831
 832         crypto_mod_put(alg);
 833         alg = crypto_alg_mod_lookup(name, type | CRYPTO_ALG_TESTED,
 834                                     mask & ~CRYPTO_ALG_TESTED);
 835         if (IS_ERR(alg))
 836                 return alg;
 837
 838         if (alg->cra_type == &crypto_aead_type) {
 839                 if (~alg->cra_flags & (type ^ ~mask) & CRYPTO_ALG_TESTED) {
 840                         crypto_mod_put(alg);
 841                         alg = ERR_PTR(-ENOENT);
 842                 }
 843                 return alg;
 844         }
 845
 846         BUG_ON(!alg->cra_aead.ivsize);
 847
 848         return ERR_PTR(crypto_nivaead_default(alg, type, mask));
 849 }
 850 EXPORT_SYMBOL_GPL(crypto_lookup_aead);
 851
 852 int crypto_grab_aead(struct crypto_aead_spawn *spawn, const char *name,
 853                      u32 type, u32 mask)
 854 {
 855         spawn->base.frontend = &crypto_aead_type;
 856         return crypto_grab_spawn(&spawn->base, name, type, mask);
 857 }
 858 EXPORT_SYMBOL_GPL(crypto_grab_aead);
 859
 860 struct crypto_aead *crypto_alloc_aead(const char *alg_name, u32 type, u32 mask)
 861 {
 862         return crypto_alloc_tfm(alg_name, &crypto_aead_type, type, mask);
 863 }
 864 EXPORT_SYMBOL_GPL(crypto_alloc_aead);
 865
 866 static int aead_prepare_alg(struct aead_alg *alg)
 867 {
 868         struct crypto_alg *base = &alg->base;
 869
 870         if (max(alg->maxauthsize, alg->ivsize) > PAGE_SIZE / 8)
 871                 return -EINVAL;
 872
 873         base->cra_type = &crypto_new_aead_type;
 874         base->cra_flags &= ~CRYPTO_ALG_TYPE_MASK;
 875         base->cra_flags |= CRYPTO_ALG_TYPE_AEAD;
 876
 877         return 0;
 878 }
 879
 880 int crypto_register_aead(struct aead_alg *alg)
 881 {
 882         struct crypto_alg *base = &alg->base;
 883         int err;
 884
 885         err = aead_prepare_alg(alg);
 886         if (err)
 887                 return err;
 888
 889         return crypto_register_alg(base);
 890 }
 891 EXPORT_SYMBOL_GPL(crypto_register_aead);
 892
 893 void crypto_unregister_aead(struct aead_alg *alg)
 894 {
 895         crypto_unregister_alg(&alg->base);
 896 }
 897 EXPORT_SYMBOL_GPL(crypto_unregister_aead);
 898
 899 int crypto_register_aeads(struct aead_alg *algs, int count)
 900 {
 901         int i, ret;
 902
 903         for (i = 0; i < count; i++) {
 904                 ret = crypto_register_aead(&algs[i]);
 905                 if (ret)
 906                         goto err;
 907         }
 908
 909         return 0;
 910
 911 err:
 912         for (--i; i >= 0; --i)
 913                 crypto_unregister_aead(&algs[i]);
 914
 915         return ret;
 916 }
 917 EXPORT_SYMBOL_GPL(crypto_register_aeads);
 918
 919 void crypto_unregister_aeads(struct aead_alg *algs, int count)
 920 {
 921         int i;
 922
 923         for (i = count - 1; i >= 0; --i)
 924                 crypto_unregister_aead(&algs[i]);
 925 }
 926 EXPORT_SYMBOL_GPL(crypto_unregister_aeads);
 927
 928 int aead_register_instance(struct crypto_template *tmpl,
 929                            struct aead_instance *inst)
 930 {
 931         int err;
 932
 933         err = aead_prepare_alg(&inst->alg);
 934         if (err)
 935                 return err;
 936
 937         return crypto_register_instance(tmpl, aead_crypto_instance(inst));
 938 }
 939 EXPORT_SYMBOL_GPL(aead_register_instance);
 940
 941 MODULE_LICENSE("GPL");
 942 MODULE_DESCRIPTION("Authenticated Encryption with Associated Data (AEAD)");