projects/linux·blob master · refs

548 lines · 13.5 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Synchronous Cryptographic Hash operations.
4 *
5 * Copyright (c) 2008 Herbert Xu <[email protected]>
6 */
7
8#include <crypto/scatterwalk.h>
9#include <linux/cryptouser.h>
10#include <linux/err.h>
11#include <linux/kernel.h>
12#include <linux/module.h>
13#include <linux/seq_file.h>
14#include <linux/string.h>
15#include <net/netlink.h>
16
17#include "hash.h"
18
19static inline bool crypto_shash_block_only(struct crypto_shash *tfm)
20{
21 return crypto_shash_alg(tfm)->base.cra_flags &
22 CRYPTO_AHASH_ALG_BLOCK_ONLY;
23}
24
25static inline bool crypto_shash_final_nonzero(struct crypto_shash *tfm)
26{
27 return crypto_shash_alg(tfm)->base.cra_flags &
28 CRYPTO_AHASH_ALG_FINAL_NONZERO;
29}
30
31static inline bool crypto_shash_finup_max(struct crypto_shash *tfm)
32{
33 return crypto_shash_alg(tfm)->base.cra_flags &
34 CRYPTO_AHASH_ALG_FINUP_MAX;
35}
36
37int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
38 unsigned int keylen)
39{
40 return -ENOSYS;
41}
42EXPORT_SYMBOL_GPL(shash_no_setkey);
43
44static void shash_set_needkey(struct crypto_shash *tfm, struct shash_alg *alg)
45{
46 if (crypto_shash_alg_needs_key(alg))
47 crypto_shash_set_flags(tfm, CRYPTO_TFM_NEED_KEY);
48}
49
50int crypto_shash_setkey(struct crypto_shash *tfm, const u8 *key,
51 unsigned int keylen)
52{
53 struct shash_alg *shash = crypto_shash_alg(tfm);
54 int err;
55
56 err = shash->setkey(tfm, key, keylen);
57 if (unlikely(err)) {
58 shash_set_needkey(tfm, shash);
59 return err;
60 }
61
62 crypto_shash_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
63 return 0;
64}
65EXPORT_SYMBOL_GPL(crypto_shash_setkey);
66
67static int __crypto_shash_init(struct shash_desc *desc)
68{
69 struct crypto_shash *tfm = desc->tfm;
70
71 if (crypto_shash_block_only(tfm)) {
72 u8 *buf = shash_desc_ctx(desc);
73
74 buf += crypto_shash_descsize(tfm) - 1;
75 *buf = 0;
76 }
77
78 return crypto_shash_alg(tfm)->init(desc);
79}
80
81int crypto_shash_init(struct shash_desc *desc)
82{
83 if (crypto_shash_get_flags(desc->tfm) & CRYPTO_TFM_NEED_KEY)
84 return -ENOKEY;
85 return __crypto_shash_init(desc);
86}
87EXPORT_SYMBOL_GPL(crypto_shash_init);
88
89static int shash_default_finup(struct shash_desc *desc, const u8 *data,
90 unsigned int len, u8 *out)
91{
92 struct shash_alg *shash = crypto_shash_alg(desc->tfm);
93
94 return shash->update(desc, data, len) ?:
95 shash->final(desc, out);
96}
97
98static int crypto_shash_op_and_zero(
99 int (*op)(struct shash_desc *desc, const u8 *data,
100 unsigned int len, u8 *out),
101 struct shash_desc *desc, const u8 *data, unsigned int len, u8 *out)
102{
103 int err;
104
105 err = op(desc, data, len, out);
106 memset(shash_desc_ctx(desc), 0, crypto_shash_descsize(desc->tfm));
107 return err;
108}
109
110int crypto_shash_finup(struct shash_desc *restrict desc, const u8 *data,
111 unsigned int len, u8 *restrict out)
112{
113 struct crypto_shash *tfm = desc->tfm;
114 u8 *blenp = shash_desc_ctx(desc);
115 bool finup_max, nonzero;
116 unsigned int bs;
117 int err;
118 u8 *buf;
119
120 if (!crypto_shash_block_only(tfm)) {
121 if (out)
122 goto finup;
123 return crypto_shash_alg(tfm)->update(desc, data, len);
124 }
125
126 finup_max = out && crypto_shash_finup_max(tfm);
127
128 /* Retain extra block for final nonzero algorithms. */
129 nonzero = crypto_shash_final_nonzero(tfm);
130
131 /*
132 * The partial block buffer follows the algorithm desc context.
133 * The byte following that contains the length.
134 */
135 blenp += crypto_shash_descsize(tfm) - 1;
136 bs = crypto_shash_blocksize(tfm);
137 buf = blenp - bs;
138
139 if (likely(!*blenp && finup_max))
140 goto finup;
141
142 while ((*blenp + len) >= bs + nonzero) {
143 unsigned int nbytes = len - nonzero;
144 const u8 *src = data;
145
146 if (*blenp) {
147 memcpy(buf + *blenp, data, bs - *blenp);
148 nbytes = bs;
149 src = buf;
150 }
151
152 err = crypto_shash_alg(tfm)->update(desc, src, nbytes);
153 if (err < 0)
154 return err;
155
156 data += nbytes - err - *blenp;
157 len -= nbytes - err - *blenp;
158 *blenp = 0;
159 }
160
161 if (*blenp || !out) {
162 memcpy(buf + *blenp, data, len);
163 *blenp += len;
164 if (!out)
165 return 0;
166 data = buf;
167 len = *blenp;
168 }
169
170finup:
171 return crypto_shash_op_and_zero(crypto_shash_alg(tfm)->finup, desc,
172 data, len, out);
173}
174EXPORT_SYMBOL_GPL(crypto_shash_finup);
175
176static int shash_default_digest(struct shash_desc *desc, const u8 *data,
177 unsigned int len, u8 *out)
178{
179 return __crypto_shash_init(desc) ?:
180 crypto_shash_finup(desc, data, len, out);
181}
182
183int crypto_shash_digest(struct shash_desc *desc, const u8 *data,
184 unsigned int len, u8 *out)
185{
186 struct crypto_shash *tfm = desc->tfm;
187
188 if (crypto_shash_get_flags(tfm) & CRYPTO_TFM_NEED_KEY)
189 return -ENOKEY;
190
191 return crypto_shash_op_and_zero(crypto_shash_alg(tfm)->digest, desc,
192 data, len, out);
193}
194EXPORT_SYMBOL_GPL(crypto_shash_digest);
195
196int crypto_shash_tfm_digest(struct crypto_shash *tfm, const u8 *data,
197 unsigned int len, u8 *out)
198{
199 SHASH_DESC_ON_STACK(desc, tfm);
200
201 desc->tfm = tfm;
202 return crypto_shash_digest(desc, data, len, out);
203}
204EXPORT_SYMBOL_GPL(crypto_shash_tfm_digest);
205
206static int __crypto_shash_export(struct shash_desc *desc, void *out,
207 int (*export)(struct shash_desc *desc,
208 void *out))
209{
210 struct crypto_shash *tfm = desc->tfm;
211 u8 *buf = shash_desc_ctx(desc);
212 unsigned int plen, ss;
213
214 plen = crypto_shash_blocksize(tfm) + 1;
215 ss = crypto_shash_statesize(tfm);
216 if (crypto_shash_block_only(tfm))
217 ss -= plen;
218 if (!export) {
219 memcpy(out, buf, ss);
220 return 0;
221 }
222
223 return export(desc, out);
224}
225
226int crypto_shash_export_core(struct shash_desc *desc, void *out)
227{
228 return __crypto_shash_export(desc, out,
229 crypto_shash_alg(desc->tfm)->export_core);
230}
231EXPORT_SYMBOL_GPL(crypto_shash_export_core);
232
233int crypto_shash_export(struct shash_desc *desc, void *out)
234{
235 struct crypto_shash *tfm = desc->tfm;
236
237 if (crypto_shash_block_only(tfm)) {
238 unsigned int plen = crypto_shash_blocksize(tfm) + 1;
239 unsigned int descsize = crypto_shash_descsize(tfm);
240 unsigned int ss = crypto_shash_statesize(tfm);
241 u8 *buf = shash_desc_ctx(desc);
242
243 memcpy(out + ss - plen, buf + descsize - plen, plen);
244 }
245 return __crypto_shash_export(desc, out, crypto_shash_alg(tfm)->export);
246}
247EXPORT_SYMBOL_GPL(crypto_shash_export);
248
249static int __crypto_shash_import(struct shash_desc *desc, const void *in,
250 int (*import)(struct shash_desc *desc,
251 const void *in))
252{
253 struct crypto_shash *tfm = desc->tfm;
254 unsigned int descsize, plen, ss;
255 u8 *buf = shash_desc_ctx(desc);
256
257 if (crypto_shash_get_flags(tfm) & CRYPTO_TFM_NEED_KEY)
258 return -ENOKEY;
259
260 ss = crypto_shash_statesize(tfm);
261 if (crypto_shash_block_only(tfm)) {
262 plen = crypto_shash_blocksize(tfm) + 1;
263 ss -= plen;
264 descsize = crypto_shash_descsize(tfm);
265 buf[descsize - 1] = 0;
266 }
267 if (!import) {
268 memcpy(buf, in, ss);
269 return 0;
270 }
271
272 return import(desc, in);
273}
274
275int crypto_shash_import_core(struct shash_desc *desc, const void *in)
276{
277 return __crypto_shash_import(desc, in,
278 crypto_shash_alg(desc->tfm)->import_core);
279}
280EXPORT_SYMBOL_GPL(crypto_shash_import_core);
281
282int crypto_shash_import(struct shash_desc *desc, const void *in)
283{
284 struct crypto_shash *tfm = desc->tfm;
285 int err;
286
287 err = __crypto_shash_import(desc, in, crypto_shash_alg(tfm)->import);
288 if (crypto_shash_block_only(tfm)) {
289 unsigned int plen = crypto_shash_blocksize(tfm) + 1;
290 unsigned int descsize = crypto_shash_descsize(tfm);
291 unsigned int ss = crypto_shash_statesize(tfm);
292 u8 *buf = shash_desc_ctx(desc);
293
294 memcpy(buf + descsize - plen, in + ss - plen, plen);
295 if (buf[descsize - 1] >= plen)
296 err = -EOVERFLOW;
297 }
298 return err;
299}
300EXPORT_SYMBOL_GPL(crypto_shash_import);
301
302static void crypto_shash_exit_tfm(struct crypto_tfm *tfm)
303{
304 struct crypto_shash *hash = __crypto_shash_cast(tfm);
305 struct shash_alg *alg = crypto_shash_alg(hash);
306
307 alg->exit_tfm(hash);
308}
309
310static int crypto_shash_init_tfm(struct crypto_tfm *tfm)
311{
312 struct crypto_shash *hash = __crypto_shash_cast(tfm);
313 struct shash_alg *alg = crypto_shash_alg(hash);
314
315 shash_set_needkey(hash, alg);
316
317 if (alg->exit_tfm)
318 tfm->exit = crypto_shash_exit_tfm;
319
320 if (!alg->init_tfm)
321 return 0;
322
323 return alg->init_tfm(hash);
324}
325
326static void crypto_shash_free_instance(struct crypto_instance *inst)
327{
328 struct shash_instance *shash = shash_instance(inst);
329
330 shash->free(shash);
331}
332
333static int __maybe_unused crypto_shash_report(
334 struct sk_buff *skb, struct crypto_alg *alg)
335{
336 struct shash_alg *salg = __crypto_shash_alg(alg);
337 struct crypto_report_hash rhash = {
338 .type = "shash",
339 };
340
341 rhash.blocksize = alg->cra_blocksize;
342 rhash.digestsize = salg->digestsize;
343
344 return nla_put(skb, CRYPTOCFGA_REPORT_HASH, sizeof(rhash), &rhash);
345}
346
347static void __maybe_unused crypto_shash_show(struct seq_file *m,
348 struct crypto_alg *alg)
349{
350 struct shash_alg *salg = __crypto_shash_alg(alg);
351
352 seq_printf(m, "type : shash\n");
353 seq_printf(m, "blocksize : %u\n", alg->cra_blocksize);
354 seq_printf(m, "digestsize : %u\n", salg->digestsize);
355}
356
357const struct crypto_type crypto_shash_type = {
358 .extsize = crypto_alg_extsize,
359 .init_tfm = crypto_shash_init_tfm,
360 .free = crypto_shash_free_instance,
361#ifdef CONFIG_PROC_FS
362 .show = crypto_shash_show,
363#endif
364#if IS_ENABLED(CONFIG_CRYPTO_USER)
365 .report = crypto_shash_report,
366#endif
367 .maskclear = ~CRYPTO_ALG_TYPE_MASK,
368 .maskset = CRYPTO_ALG_TYPE_MASK,
369 .type = CRYPTO_ALG_TYPE_SHASH,
370 .tfmsize = offsetof(struct crypto_shash, base),
371 .algsize = offsetof(struct shash_alg, base),
372};
373
374int crypto_grab_shash(struct crypto_shash_spawn *spawn,
375 struct crypto_instance *inst,
376 const char *name, u32 type, u32 mask)
377{
378 spawn->base.frontend = &crypto_shash_type;
379 return crypto_grab_spawn(&spawn->base, inst, name, type, mask);
380}
381EXPORT_SYMBOL_GPL(crypto_grab_shash);
382
383struct crypto_shash *crypto_alloc_shash(const char *alg_name, u32 type,
384 u32 mask)
385{
386 return crypto_alloc_tfm(alg_name, &crypto_shash_type, type, mask);
387}
388EXPORT_SYMBOL_GPL(crypto_alloc_shash);
389
390int crypto_has_shash(const char *alg_name, u32 type, u32 mask)
391{
392 return crypto_type_has_alg(alg_name, &crypto_shash_type, type, mask);
393}
394EXPORT_SYMBOL_GPL(crypto_has_shash);
395
396int hash_prepare_alg(struct hash_alg_common *alg)
397{
398 struct crypto_alg *base = &alg->base;
399
400 if (alg->digestsize > HASH_MAX_DIGESTSIZE)
401 return -EINVAL;
402
403 /* alignmask is not useful for hashes, so it is not supported. */
404 if (base->cra_alignmask)
405 return -EINVAL;
406
407 base->cra_flags &= ~CRYPTO_ALG_TYPE_MASK;
408
409 return 0;
410}
411
412static int shash_default_export_core(struct shash_desc *desc, void *out)
413{
414 return -ENOSYS;
415}
416
417static int shash_default_import_core(struct shash_desc *desc, const void *in)
418{
419 return -ENOSYS;
420}
421
422static int shash_prepare_alg(struct shash_alg *alg)
423{
424 struct crypto_alg *base = &alg->halg.base;
425 int err;
426
427 if ((alg->export && !alg->import) || (alg->import && !alg->export))
428 return -EINVAL;
429
430 err = hash_prepare_alg(&alg->halg);
431 if (err)
432 return err;
433
434 base->cra_type = &crypto_shash_type;
435 base->cra_flags |= CRYPTO_ALG_TYPE_SHASH;
436 base->cra_flags |= CRYPTO_ALG_REQ_VIRT;
437
438 /*
439 * Handle missing optional functions. For each one we can either
440 * install a default here, or we can leave the pointer as NULL and check
441 * the pointer for NULL in crypto_shash_*(), avoiding an indirect call
442 * when the default behavior is desired. For ->finup and ->digest we
443 * install defaults, since for optimal performance algorithms should
444 * implement these anyway. On the other hand, for ->import and
445 * ->export the common case and best performance comes from the simple
446 * memcpy of the shash_desc_ctx, so when those pointers are NULL we
447 * leave them NULL and provide the memcpy with no indirect call.
448 */
449 if (!alg->finup)
450 alg->finup = shash_default_finup;
451 if (!alg->digest)
452 alg->digest = shash_default_digest;
453 if (!alg->export && !alg->halg.statesize)
454 alg->halg.statesize = alg->descsize;
455 if (!alg->setkey)
456 alg->setkey = shash_no_setkey;
457
458 if (base->cra_flags & CRYPTO_AHASH_ALG_BLOCK_ONLY) {
459 BUILD_BUG_ON(MAX_ALGAPI_BLOCKSIZE >= 256);
460 alg->descsize += base->cra_blocksize + 1;
461 alg->statesize += base->cra_blocksize + 1;
462 alg->export_core = alg->export;
463 alg->import_core = alg->import;
464 } else if (!alg->export_core || !alg->import_core) {
465 alg->export_core = shash_default_export_core;
466 alg->import_core = shash_default_import_core;
467 base->cra_flags |= CRYPTO_AHASH_ALG_NO_EXPORT_CORE;
468 }
469
470 if (alg->descsize > HASH_MAX_DESCSIZE)
471 return -EINVAL;
472 if (alg->statesize > HASH_MAX_STATESIZE)
473 return -EINVAL;
474
475 base->cra_reqsize = sizeof(struct shash_desc) + alg->descsize;
476
477 return 0;
478}
479
480int crypto_register_shash(struct shash_alg *alg)
481{
482 struct crypto_alg *base = &alg->base;
483 int err;
484
485 err = shash_prepare_alg(alg);
486 if (err)
487 return err;
488
489 return crypto_register_alg(base);
490}
491EXPORT_SYMBOL_GPL(crypto_register_shash);
492
493void crypto_unregister_shash(struct shash_alg *alg)
494{
495 crypto_unregister_alg(&alg->base);
496}
497EXPORT_SYMBOL_GPL(crypto_unregister_shash);
498
499int crypto_register_shashes(struct shash_alg *algs, int count)
500{
501 int i, ret;
502
503 for (i = 0; i < count; i++) {
504 ret = crypto_register_shash(&algs[i]);
505 if (ret) {
506 crypto_unregister_shashes(algs, i);
507 return ret;
508 }
509 }
510
511 return 0;
512}
513EXPORT_SYMBOL_GPL(crypto_register_shashes);
514
515void crypto_unregister_shashes(struct shash_alg *algs, int count)
516{
517 int i;
518
519 for (i = count - 1; i >= 0; --i)
520 crypto_unregister_shash(&algs[i]);
521}
522EXPORT_SYMBOL_GPL(crypto_unregister_shashes);
523
524int shash_register_instance(struct crypto_template *tmpl,
525 struct shash_instance *inst)
526{
527 int err;
528
529 if (WARN_ON(!inst->free))
530 return -EINVAL;
531
532 err = shash_prepare_alg(&inst->alg);
533 if (err)
534 return err;
535
536 return crypto_register_instance(tmpl, shash_crypto_instance(inst));
537}
538EXPORT_SYMBOL_GPL(shash_register_instance);
539
540void shash_free_singlespawn_instance(struct shash_instance *inst)
541{
542 crypto_drop_spawn(shash_instance_ctx(inst));
543 kfree(inst);
544}
545EXPORT_SYMBOL_GPL(shash_free_singlespawn_instance);
546
547MODULE_LICENSE("GPL");
548MODULE_DESCRIPTION("Synchronous cryptographic hash type");