1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * algif_skcipher: User-space interface for skcipher algorithms 4 * 5 * This file provides the user-space API for symmetric key ciphers. 6 * 7 * Copyright (c) 2010 Herbert Xu <herbert@gondor.apana.org.au> 8 * 9 * The following concept of the memory management is used: 10 * 11 * The kernel maintains two SGLs, the TX SGL and the RX SGL. The TX SGL is 12 * filled by user space with the data submitted via sendmsg. Filling up the TX 13 * SGL does not cause a crypto operation -- the data will only be tracked by 14 * the kernel. Upon receipt of one recvmsg call, the caller must provide a 15 * buffer which is tracked with the RX SGL. 16 * 17 * During the processing of the recvmsg operation, the cipher request is 18 * allocated and prepared. As part of the recvmsg operation, the processed 19 * TX buffers are extracted from the TX SGL into a separate SGL. 20 * 21 * After the completion of the crypto operation, the RX SGL and the cipher 22 * request is released. The extracted TX SGL parts are released together with 23 * the RX SGL release. 24 */ 25 26 #include <crypto/scatterwalk.h> 27 #include <crypto/skcipher.h> 28 #include <crypto/if_alg.h> 29 #include <linux/init.h> 30 #include <linux/list.h> 31 #include <linux/kernel.h> 32 #include <linux/mm.h> 33 #include <linux/module.h> 34 #include <linux/net.h> 35 #include <net/sock.h> 36 37 static const struct af_alg_allowlist_entry skcipher_allowlist[] = { 38 { "adiantum(xchacha12,aes)", false }, /* cryptsetup */ 39 { "adiantum(xchacha20,aes)", false }, /* cryptsetup */ 40 { "cbc(aes)", true }, /* iwd */ 41 { "cbc(des)", true }, /* iwd */ 42 { "cbc(des3_ede)", true }, /* iwd */ 43 { "ctr(aes)", true }, /* iwd */ 44 { "ecb(aes)", true }, /* iwd, bluez */ 45 { "ecb(des)", true }, /* iwd */ 46 { "hctr2(aes)", false }, /* cryptsetup */ 47 { "xts(aes)", false }, /* cryptsetup benchmark */ 48 {}, 49 }; 50 51 static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg, 52 size_t size) 53 { 54 struct sock *sk = sock->sk; 55 struct alg_sock *ask = alg_sk(sk); 56 struct sock *psk = ask->parent; 57 struct alg_sock *pask = alg_sk(psk); 58 struct crypto_skcipher *tfm = pask->private; 59 unsigned ivsize = crypto_skcipher_ivsize(tfm); 60 61 return af_alg_sendmsg(sock, msg, size, ivsize); 62 } 63 64 static int algif_skcipher_export(struct sock *sk, struct skcipher_request *req) 65 { 66 struct alg_sock *ask = alg_sk(sk); 67 struct crypto_skcipher *tfm; 68 struct af_alg_ctx *ctx; 69 struct alg_sock *pask; 70 unsigned statesize; 71 struct sock *psk; 72 int err; 73 74 if (!(req->base.flags & CRYPTO_SKCIPHER_REQ_NOTFINAL)) 75 return 0; 76 77 ctx = ask->private; 78 psk = ask->parent; 79 pask = alg_sk(psk); 80 tfm = pask->private; 81 82 statesize = crypto_skcipher_statesize(tfm); 83 ctx->state = sock_kmalloc(sk, statesize, GFP_ATOMIC); 84 if (!ctx->state) 85 return -ENOMEM; 86 87 err = crypto_skcipher_export(req, ctx->state); 88 if (err) { 89 sock_kzfree_s(sk, ctx->state, statesize); 90 ctx->state = NULL; 91 } 92 93 return err; 94 } 95 96 static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, 97 size_t ignored, int flags) 98 { 99 struct sock *sk = sock->sk; 100 struct alg_sock *ask = alg_sk(sk); 101 struct sock *psk = ask->parent; 102 struct alg_sock *pask = alg_sk(psk); 103 struct af_alg_ctx *ctx = ask->private; 104 struct crypto_skcipher *tfm = pask->private; 105 unsigned int bs = crypto_skcipher_chunksize(tfm); 106 struct af_alg_async_req *areq; 107 unsigned cflags = 0; 108 int err = 0; 109 size_t len = 0; 110 111 if (!ctx->init || (ctx->more && ctx->used < bs)) { 112 err = af_alg_wait_for_data(sk, flags, bs); 113 if (err) 114 return err; 115 } 116 117 /* Allocate cipher request for current operation. */ 118 areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) + 119 crypto_skcipher_reqsize(tfm)); 120 if (IS_ERR(areq)) 121 return PTR_ERR(areq); 122 123 /* convert iovecs of output buffers into RX SGL */ 124 err = af_alg_get_rsgl(sk, msg, flags, areq, ctx->used, &len); 125 if (err) 126 goto free; 127 128 /* 129 * If more buffers are to be expected to be processed, process only 130 * full block size buffers. 131 */ 132 if (ctx->more || len < ctx->used) { 133 if (len < bs) { 134 err = -EINVAL; 135 goto free; 136 } 137 138 len -= len % bs; 139 cflags |= CRYPTO_SKCIPHER_REQ_NOTFINAL; 140 } 141 142 /* 143 * Create a per request TX SGL for this request which tracks the 144 * SG entries from the global TX SGL. 145 */ 146 areq->tsgl_entries = af_alg_count_tsgl(sk, len); 147 if (!areq->tsgl_entries) 148 areq->tsgl_entries = 1; 149 areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl), 150 areq->tsgl_entries), 151 GFP_KERNEL); 152 if (!areq->tsgl) { 153 err = -ENOMEM; 154 goto free; 155 } 156 sg_init_table(areq->tsgl, areq->tsgl_entries); 157 af_alg_pull_tsgl(sk, len, areq->tsgl); 158 159 /* Initialize the crypto operation */ 160 skcipher_request_set_tfm(&areq->cra_u.skcipher_req, tfm); 161 skcipher_request_set_crypt(&areq->cra_u.skcipher_req, areq->tsgl, 162 areq->first_rsgl.sgl.sgt.sgl, len, ctx->iv); 163 164 if (ctx->state) { 165 err = crypto_skcipher_import(&areq->cra_u.skcipher_req, 166 ctx->state); 167 sock_kzfree_s(sk, ctx->state, crypto_skcipher_statesize(tfm)); 168 ctx->state = NULL; 169 if (err) 170 goto free; 171 cflags |= CRYPTO_SKCIPHER_REQ_CONT; 172 } 173 174 skcipher_request_set_callback(&areq->cra_u.skcipher_req, 175 cflags | 176 CRYPTO_TFM_REQ_MAY_SLEEP | 177 CRYPTO_TFM_REQ_MAY_BACKLOG, 178 crypto_req_done, &ctx->wait); 179 err = crypto_wait_req(ctx->enc ? 180 crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) : 181 crypto_skcipher_decrypt(&areq->cra_u.skcipher_req), 182 &ctx->wait); 183 184 if (!err) 185 err = algif_skcipher_export( 186 sk, &areq->cra_u.skcipher_req); 187 188 free: 189 af_alg_free_resources(areq); 190 191 return err ? err : len; 192 } 193 194 static int skcipher_recvmsg(struct socket *sock, struct msghdr *msg, 195 size_t ignored, int flags) 196 { 197 struct sock *sk = sock->sk; 198 int ret = 0; 199 200 lock_sock(sk); 201 while (msg_data_left(msg)) { 202 int err = _skcipher_recvmsg(sock, msg, ignored, flags); 203 204 /* 205 * This error covers -EIOCBQUEUED which implies that we can 206 * only handle one AIO request. If the caller wants to have 207 * multiple AIO requests in parallel, he must make multiple 208 * separate AIO calls. 209 * 210 * Also return the error if no data has been processed so far. 211 */ 212 if (err <= 0) { 213 if (err == -EIOCBQUEUED || !ret) 214 ret = err; 215 goto out; 216 } 217 218 ret += err; 219 } 220 221 out: 222 af_alg_wmem_wakeup(sk); 223 release_sock(sk); 224 return ret; 225 } 226 227 static struct proto_ops algif_skcipher_ops = { 228 .family = PF_ALG, 229 230 .connect = sock_no_connect, 231 .socketpair = sock_no_socketpair, 232 .getname = sock_no_getname, 233 .ioctl = sock_no_ioctl, 234 .listen = sock_no_listen, 235 .shutdown = sock_no_shutdown, 236 .mmap = sock_no_mmap, 237 .bind = sock_no_bind, 238 .accept = sock_no_accept, 239 240 .release = af_alg_release, 241 .sendmsg = skcipher_sendmsg, 242 .recvmsg = skcipher_recvmsg, 243 .poll = af_alg_poll, 244 }; 245 246 static int skcipher_check_key(struct socket *sock) 247 { 248 int err = 0; 249 struct sock *psk; 250 struct alg_sock *pask; 251 struct crypto_skcipher *tfm; 252 struct sock *sk = sock->sk; 253 struct alg_sock *ask = alg_sk(sk); 254 255 lock_sock(sk); 256 if (!atomic_read(&ask->nokey_refcnt)) 257 goto unlock_child; 258 259 psk = ask->parent; 260 pask = alg_sk(ask->parent); 261 tfm = pask->private; 262 263 err = -ENOKEY; 264 lock_sock_nested(psk, SINGLE_DEPTH_NESTING); 265 if (crypto_skcipher_get_flags(tfm) & CRYPTO_TFM_NEED_KEY) 266 goto unlock; 267 268 atomic_dec(&pask->nokey_refcnt); 269 atomic_set(&ask->nokey_refcnt, 0); 270 271 err = 0; 272 273 unlock: 274 release_sock(psk); 275 unlock_child: 276 release_sock(sk); 277 278 return err; 279 } 280 281 static int skcipher_sendmsg_nokey(struct socket *sock, struct msghdr *msg, 282 size_t size) 283 { 284 int err; 285 286 err = skcipher_check_key(sock); 287 if (err) 288 return err; 289 290 return skcipher_sendmsg(sock, msg, size); 291 } 292 293 static int skcipher_recvmsg_nokey(struct socket *sock, struct msghdr *msg, 294 size_t ignored, int flags) 295 { 296 int err; 297 298 err = skcipher_check_key(sock); 299 if (err) 300 return err; 301 302 return skcipher_recvmsg(sock, msg, ignored, flags); 303 } 304 305 static struct proto_ops algif_skcipher_ops_nokey = { 306 .family = PF_ALG, 307 308 .connect = sock_no_connect, 309 .socketpair = sock_no_socketpair, 310 .getname = sock_no_getname, 311 .ioctl = sock_no_ioctl, 312 .listen = sock_no_listen, 313 .shutdown = sock_no_shutdown, 314 .mmap = sock_no_mmap, 315 .bind = sock_no_bind, 316 .accept = sock_no_accept, 317 318 .release = af_alg_release, 319 .sendmsg = skcipher_sendmsg_nokey, 320 .recvmsg = skcipher_recvmsg_nokey, 321 .poll = af_alg_poll, 322 }; 323 324 static void *skcipher_bind(const char *name) 325 { 326 int err; 327 328 err = af_alg_check_restriction(name, skcipher_allowlist); 329 if (err) 330 return ERR_PTR(err); 331 332 return crypto_alloc_skcipher(name, 0, AF_ALG_CRYPTOAPI_MASK); 333 } 334 335 static void skcipher_release(void *private) 336 { 337 crypto_free_skcipher(private); 338 } 339 340 static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen) 341 { 342 return crypto_skcipher_setkey(private, key, keylen); 343 } 344 345 static void skcipher_sock_destruct(struct sock *sk) 346 { 347 struct alg_sock *ask = alg_sk(sk); 348 struct af_alg_ctx *ctx = ask->private; 349 struct sock *psk = ask->parent; 350 struct alg_sock *pask = alg_sk(psk); 351 struct crypto_skcipher *tfm = pask->private; 352 353 af_alg_pull_tsgl(sk, ctx->used, NULL); 354 sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm)); 355 if (ctx->state) 356 sock_kzfree_s(sk, ctx->state, crypto_skcipher_statesize(tfm)); 357 sock_kfree_s(sk, ctx, ctx->len); 358 af_alg_release_parent(sk); 359 } 360 361 static int skcipher_accept_parent_nokey(void *private, struct sock *sk) 362 { 363 struct af_alg_ctx *ctx; 364 struct alg_sock *ask = alg_sk(sk); 365 struct crypto_skcipher *tfm = private; 366 unsigned int len = sizeof(*ctx); 367 368 ctx = sock_kmalloc(sk, len, GFP_KERNEL); 369 if (!ctx) 370 return -ENOMEM; 371 memset(ctx, 0, len); 372 373 ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm), 374 GFP_KERNEL); 375 if (!ctx->iv) { 376 sock_kfree_s(sk, ctx, len); 377 return -ENOMEM; 378 } 379 memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm)); 380 381 INIT_LIST_HEAD(&ctx->tsgl_list); 382 ctx->len = len; 383 crypto_init_wait(&ctx->wait); 384 385 ask->private = ctx; 386 387 sk->sk_destruct = skcipher_sock_destruct; 388 389 return 0; 390 } 391 392 static int skcipher_accept_parent(void *private, struct sock *sk) 393 { 394 struct crypto_skcipher *tfm = private; 395 396 if (crypto_skcipher_get_flags(tfm) & CRYPTO_TFM_NEED_KEY) 397 return -ENOKEY; 398 399 return skcipher_accept_parent_nokey(private, sk); 400 } 401 402 static const struct af_alg_type algif_type_skcipher = { 403 .bind = skcipher_bind, 404 .release = skcipher_release, 405 .setkey = skcipher_setkey, 406 .accept = skcipher_accept_parent, 407 .accept_nokey = skcipher_accept_parent_nokey, 408 .ops = &algif_skcipher_ops, 409 .ops_nokey = &algif_skcipher_ops_nokey, 410 .name = "skcipher", 411 .owner = THIS_MODULE 412 }; 413 414 static int __init algif_skcipher_init(void) 415 { 416 return af_alg_register_type(&algif_type_skcipher); 417 } 418 419 static void __exit algif_skcipher_exit(void) 420 { 421 int err = af_alg_unregister_type(&algif_type_skcipher); 422 BUG_ON(err); 423 } 424 425 module_init(algif_skcipher_init); 426 module_exit(algif_skcipher_exit); 427 MODULE_DESCRIPTION("Userspace interface for skcipher algorithms"); 428 MODULE_LICENSE("GPL"); 429