xref: /titanic_51/usr/src/uts/common/io/cryptmod.c (revision 84e1ed4249618c81c3c770730fe3e5ba51a9a246)
1 /*
2  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  *
5  * STREAMS Crypto Module
6  *
7  * This module is used to facilitate Kerberos encryption
8  * operations for the telnet daemon and rlogin daemon.
9  * Because the Solaris telnet and rlogin daemons run mostly
10  * in-kernel via 'telmod' and 'rlmod', this module must be
11  * pushed on the STREAM *below* telmod or rlmod.
12  *
13  * Parts of the 3DES key derivation code are covered by the
14  * following copyright.
15  *
16  * Copyright (C) 1998 by the FundsXpress, INC.
17  *
18  * All rights reserved.
19  *
20  * Export of this software from the United States of America may require
21  * a specific license from the United States Government.  It is the
22  * responsibility of any person or organization contemplating export to
23  * obtain such a license before exporting.
24  *
25  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
26  * distribute this software and its documentation for any purpose and
27  * without fee is hereby granted, provided that the above copyright
28  * notice appear in all copies and that both that copyright notice and
29  * this permission notice appear in supporting documentation, and that
30  * the name of FundsXpress. not be used in advertising or publicity pertaining
31  * to distribution of the software without specific, written prior
32  * permission.  FundsXpress makes no representations about the suitability of
33  * this software for any purpose.  It is provided "as is" without express
34  * or implied warranty.
35  *
36  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
37  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
38  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
39  */
40 
41 #include <sys/types.h>
42 #include <sys/sysmacros.h>
43 #include <sys/errno.h>
44 #include <sys/debug.h>
45 #include <sys/time.h>
46 #include <sys/stropts.h>
47 #include <sys/stream.h>
48 #include <sys/strsubr.h>
49 #include <sys/strlog.h>
50 #include <sys/cmn_err.h>
51 #include <sys/conf.h>
52 #include <sys/sunddi.h>
53 #include <sys/kmem.h>
54 #include <sys/strsun.h>
55 #include <sys/random.h>
56 #include <sys/types.h>
57 #include <sys/byteorder.h>
58 #include <sys/cryptmod.h>
59 #include <sys/crc32.h>
60 #include <sys/policy.h>
61 
62 #include <sys/crypto/api.h>
63 
64 /*
65  * Function prototypes.
66  */
67 static	int	cryptmodopen(queue_t *, dev_t *, int, int, cred_t *);
68 static  void	cryptmodrput(queue_t *, mblk_t *);
69 static  void	cryptmodwput(queue_t *, mblk_t *);
70 static	int	cryptmodclose(queue_t *);
71 static	int	cryptmodwsrv(queue_t *);
72 static	int	cryptmodrsrv(queue_t *);
73 
74 static mblk_t *do_encrypt(queue_t *q, mblk_t *mp);
75 static mblk_t *do_decrypt(queue_t *q, mblk_t *mp);
76 
77 #define	CRYPTMOD_ID 5150
78 
79 #define	CFB_BLKSZ 8
80 
81 #define	K5CLENGTH 5
82 
83 static struct module_info	cryptmod_minfo = {
84 	CRYPTMOD_ID,	/* mi_idnum */
85 	"cryptmod",	/* mi_idname */
86 	0,		/* mi_minpsz */
87 	INFPSZ,		/* mi_maxpsz */
88 	65536,		/* mi_hiwat */
89 	1024		/* mi_lowat */
90 };
91 
92 static struct qinit	cryptmod_rinit = {
93 	(int (*)())cryptmodrput,	/* qi_putp */
94 	cryptmodrsrv,	/* qi_svc */
95 	cryptmodopen,	/* qi_qopen */
96 	cryptmodclose,	/* qi_qclose */
97 	NULL,		/* qi_qadmin */
98 	&cryptmod_minfo,	/* qi_minfo */
99 	NULL		/* qi_mstat */
100 };
101 
102 static struct qinit	cryptmod_winit = {
103 	(int (*)())cryptmodwput,	/* qi_putp */
104 	cryptmodwsrv,	/* qi_srvp */
105 	NULL,		/* qi_qopen */
106 	NULL,		/* qi_qclose */
107 	NULL,		/* qi_qadmin */
108 	&cryptmod_minfo,	/* qi_minfo */
109 	NULL		/* qi_mstat */
110 };
111 
112 static struct streamtab	cryptmod_info = {
113 	&cryptmod_rinit,	/* st_rdinit */
114 	&cryptmod_winit,	/* st_wrinit */
115 	NULL,	/* st_muxrinit */
116 	NULL	/* st_muxwinit */
117 };
118 
119 typedef struct {
120 	uint_t hash_len;
121 	uint_t confound_len;
122 	int (*hashfunc)();
123 } hash_info_t;
124 
125 #define	MAX_CKSUM_LEN 20
126 #define	CONFOUNDER_LEN 8
127 
128 #define	SHA1_HASHSIZE 20
129 #define	MD5_HASHSIZE 16
130 #define	CRC32_HASHSIZE 4
131 #define	MSGBUF_SIZE 4096
132 #define	CONFOUNDER_BYTES 128
133 
134 
135 static int crc32_calc(uchar_t *, uchar_t *, uint_t);
136 static int md5_calc(uchar_t *, uchar_t *, uint_t);
137 static int sha1_calc(uchar_t *, uchar_t *, uint_t);
138 
139 static hash_info_t null_hash = {0, 0, NULL};
140 static hash_info_t crc32_hash = {CRC32_HASHSIZE, CONFOUNDER_LEN, crc32_calc};
141 static hash_info_t md5_hash = {MD5_HASHSIZE, CONFOUNDER_LEN, md5_calc};
142 static hash_info_t sha1_hash = {SHA1_HASHSIZE, CONFOUNDER_LEN, sha1_calc};
143 
144 static crypto_mech_type_t sha1_hmac_mech = CRYPTO_MECH_INVALID;
145 static crypto_mech_type_t md5_hmac_mech = CRYPTO_MECH_INVALID;
146 static crypto_mech_type_t sha1_hash_mech = CRYPTO_MECH_INVALID;
147 static crypto_mech_type_t md5_hash_mech = CRYPTO_MECH_INVALID;
148 
149 static int kef_crypt(struct cipher_data_t *, void *,
150 		    crypto_data_format_t, size_t, int);
151 static mblk_t *
152 arcfour_hmac_md5_encrypt(queue_t *, struct tmodinfo *,
153 		mblk_t *, hash_info_t *);
154 static mblk_t *
155 arcfour_hmac_md5_decrypt(queue_t *, struct tmodinfo *,
156 		mblk_t *, hash_info_t *);
157 
158 static int
159 do_hmac(crypto_mech_type_t, crypto_key_t *, char *, int, char *, int);
160 
161 /*
162  * This is the loadable module wrapper.
163  */
164 #include <sys/modctl.h>
165 
166 static struct fmodsw fsw = {
167 	"cryptmod",
168 	&cryptmod_info,
169 	D_MP | D_MTQPAIR
170 };
171 
172 /*
173  * Module linkage information for the kernel.
174  */
175 static struct modlstrmod modlstrmod = {
176 	&mod_strmodops,
177 	"STREAMS encryption module",
178 	&fsw
179 };
180 
181 static struct modlinkage modlinkage = {
182 	MODREV_1,
183 	&modlstrmod,
184 	NULL
185 };
186 
187 int
188 _init(void)
189 {
190 	return (mod_install(&modlinkage));
191 }
192 
193 int
194 _fini(void)
195 {
196 	return (mod_remove(&modlinkage));
197 }
198 
199 int
200 _info(struct modinfo *modinfop)
201 {
202 	return (mod_info(&modlinkage, modinfop));
203 }
204 
205 static void
206 cleanup(struct cipher_data_t *cd)
207 {
208 	if (cd->key != NULL) {
209 		bzero(cd->key, cd->keylen);
210 		kmem_free(cd->key, cd->keylen);
211 		cd->key = NULL;
212 	}
213 
214 	if (cd->ckey != NULL) {
215 		/*
216 		 * ckey is a crypto_key_t structure which references
217 		 * "cd->key" for its raw key data.  Since that was already
218 		 * cleared out, we don't need another "bzero" here.
219 		 */
220 		kmem_free(cd->ckey, sizeof (crypto_key_t));
221 		cd->ckey = NULL;
222 	}
223 
224 	if (cd->block != NULL) {
225 		kmem_free(cd->block, cd->blocklen);
226 		cd->block = NULL;
227 	}
228 
229 	if (cd->saveblock != NULL) {
230 		kmem_free(cd->saveblock, cd->blocklen);
231 		cd->saveblock = NULL;
232 	}
233 
234 	if (cd->ivec != NULL) {
235 		kmem_free(cd->ivec, cd->ivlen);
236 		cd->ivec = NULL;
237 	}
238 
239 	if (cd->d_encr_key.ck_data != NULL) {
240 		bzero(cd->d_encr_key.ck_data, cd->keylen);
241 		kmem_free(cd->d_encr_key.ck_data, cd->keylen);
242 	}
243 
244 	if (cd->d_hmac_key.ck_data != NULL) {
245 		bzero(cd->d_hmac_key.ck_data, cd->keylen);
246 		kmem_free(cd->d_hmac_key.ck_data, cd->keylen);
247 	}
248 
249 	if (cd->enc_tmpl != NULL)
250 		(void) crypto_destroy_ctx_template(cd->enc_tmpl);
251 
252 	if (cd->hmac_tmpl != NULL)
253 		(void) crypto_destroy_ctx_template(cd->hmac_tmpl);
254 
255 	if (cd->ctx != NULL) {
256 		crypto_cancel_ctx(cd->ctx);
257 		cd->ctx = NULL;
258 	}
259 }
260 
261 /* ARGSUSED */
262 static int
263 cryptmodopen(queue_t *rq, dev_t *dev, int oflag, int sflag, cred_t *crp)
264 {
265 	struct tmodinfo	*tmi;
266 	ASSERT(rq);
267 
268 	if (sflag != MODOPEN)
269 		return (EINVAL);
270 
271 	(void) (STRLOG(CRYPTMOD_ID, 0, 5, SL_TRACE|SL_NOTE,
272 			"cryptmodopen: opening module(PID %d)",
273 			ddi_get_pid()));
274 
275 	if (rq->q_ptr != NULL) {
276 		cmn_err(CE_WARN, "cryptmodopen: already opened");
277 		return (0);
278 	}
279 
280 	/*
281 	 * Allocate and initialize per-Stream structure.
282 	 */
283 	tmi = (struct tmodinfo *)kmem_zalloc(sizeof (struct tmodinfo),
284 						KM_SLEEP);
285 
286 	tmi->enc_data.method = CRYPT_METHOD_NONE;
287 	tmi->dec_data.method = CRYPT_METHOD_NONE;
288 
289 	tmi->ready = (CRYPT_READ_READY | CRYPT_WRITE_READY);
290 
291 	rq->q_ptr = WR(rq)->q_ptr = tmi;
292 
293 	sha1_hmac_mech = crypto_mech2id(SUN_CKM_SHA1_HMAC);
294 	md5_hmac_mech = crypto_mech2id(SUN_CKM_MD5_HMAC);
295 	sha1_hash_mech = crypto_mech2id(SUN_CKM_SHA1);
296 	md5_hash_mech = crypto_mech2id(SUN_CKM_MD5);
297 
298 	qprocson(rq);
299 
300 	return (0);
301 }
302 
303 static int
304 cryptmodclose(queue_t *rq)
305 {
306 	struct tmodinfo *tmi = (struct tmodinfo *)rq->q_ptr;
307 	ASSERT(tmi);
308 
309 	qprocsoff(rq);
310 
311 	cleanup(&tmi->enc_data);
312 	cleanup(&tmi->dec_data);
313 
314 	kmem_free(tmi, sizeof (struct tmodinfo));
315 	rq->q_ptr = WR(rq)->q_ptr = NULL;
316 
317 	return (0);
318 }
319 
320 /*
321  * plaintext_offset
322  *
323  * Calculate exactly how much space is needed in front
324  * of the "plaintext" in an mbuf so it can be positioned
325  * 1 time instead of potentially moving the data multiple
326  * times.
327  */
328 static int
329 plaintext_offset(struct cipher_data_t *cd)
330 {
331 	int headspace = 0;
332 
333 	/* 4 byte length prepended to all RCMD msgs */
334 	if (ANY_RCMD_MODE(cd->option_mask))
335 		headspace += RCMD_LEN_SZ;
336 
337 	/* RCMD V2 mode adds an additional 4 byte plaintext length */
338 	if (cd->option_mask & CRYPTOPT_RCMD_MODE_V2)
339 		headspace += RCMD_LEN_SZ;
340 
341 	/* Need extra space for hash and counfounder */
342 	switch (cd->method) {
343 	case CRYPT_METHOD_DES_CBC_NULL:
344 		headspace += null_hash.hash_len + null_hash.confound_len;
345 		break;
346 	case CRYPT_METHOD_DES_CBC_CRC:
347 		headspace += crc32_hash.hash_len + crc32_hash.confound_len;
348 		break;
349 	case CRYPT_METHOD_DES_CBC_MD5:
350 		headspace += md5_hash.hash_len + md5_hash.confound_len;
351 		break;
352 	case CRYPT_METHOD_DES3_CBC_SHA1:
353 		headspace += sha1_hash.confound_len;
354 		break;
355 	case CRYPT_METHOD_ARCFOUR_HMAC_MD5:
356 		headspace += md5_hash.hash_len + md5_hash.confound_len;
357 		break;
358 	case CRYPT_METHOD_AES128:
359 	case CRYPT_METHOD_AES256:
360 		headspace += DEFAULT_AES_BLOCKLEN;
361 		break;
362 	case CRYPT_METHOD_DES_CFB:
363 	case CRYPT_METHOD_NONE:
364 		break;
365 	}
366 
367 	return (headspace);
368 }
369 /*
370  * encrypt_size
371  *
372  * Calculate the resulting size when encrypting 'plainlen' bytes
373  * of data.
374  */
375 static size_t
376 encrypt_size(struct cipher_data_t *cd, size_t plainlen)
377 {
378 	size_t cipherlen;
379 
380 	switch (cd->method) {
381 	case CRYPT_METHOD_DES_CBC_NULL:
382 		cipherlen = (size_t)P2ROUNDUP(null_hash.hash_len +
383 					    plainlen, 8);
384 		break;
385 	case CRYPT_METHOD_DES_CBC_MD5:
386 		cipherlen = (size_t)P2ROUNDUP(md5_hash.hash_len +
387 					    md5_hash.confound_len +
388 					    plainlen, 8);
389 		break;
390 	case CRYPT_METHOD_DES_CBC_CRC:
391 		cipherlen = (size_t)P2ROUNDUP(crc32_hash.hash_len +
392 					    crc32_hash.confound_len +
393 					    plainlen, 8);
394 		break;
395 	case CRYPT_METHOD_DES3_CBC_SHA1:
396 		cipherlen = (size_t)P2ROUNDUP(sha1_hash.confound_len +
397 					    plainlen, 8) +
398 					    sha1_hash.hash_len;
399 		break;
400 	case CRYPT_METHOD_ARCFOUR_HMAC_MD5:
401 		cipherlen = (size_t)P2ROUNDUP(md5_hash.confound_len +
402 				plainlen, 1) + md5_hash.hash_len;
403 		break;
404 	case CRYPT_METHOD_AES128:
405 	case CRYPT_METHOD_AES256:
406 		/* No roundup for AES-CBC-CTS */
407 		cipherlen = DEFAULT_AES_BLOCKLEN + plainlen +
408 			AES_TRUNCATED_HMAC_LEN;
409 		break;
410 	case CRYPT_METHOD_DES_CFB:
411 	case CRYPT_METHOD_NONE:
412 		cipherlen = plainlen;
413 		break;
414 	}
415 
416 	return (cipherlen);
417 }
418 
419 /*
420  * des_cfb_encrypt
421  *
422  * Encrypt the mblk data using DES with cipher feedback.
423  *
424  * Given that V[i] is the initial 64 bit vector, V[n] is the nth 64 bit
425  * vector, D[n] is the nth chunk of 64 bits of data to encrypt
426  * (decrypt), and O[n] is the nth chunk of 64 bits of encrypted
427  * (decrypted) data, then:
428  *
429  *  V[0] = DES(V[i], key)
430  *  O[n] = D[n] <exclusive or > V[n]
431  *  V[n+1] = DES(O[n], key)
432  *
433  * The size of the message being encrypted does not change in this
434  * algorithm, num_bytes in == num_bytes out.
435  */
436 static mblk_t *
437 des_cfb_encrypt(queue_t *q, struct tmodinfo *tmi, mblk_t *mp)
438 {
439 	int savedbytes;
440 	char *iptr, *optr, *lastoutput;
441 
442 	lastoutput = optr = (char *)mp->b_rptr;
443 	iptr = (char *)mp->b_rptr;
444 	savedbytes = tmi->enc_data.bytes % CFB_BLKSZ;
445 
446 	while (iptr < (char *)mp->b_wptr) {
447 		/*
448 		 * Do DES-ECB.
449 		 * The first time this runs, the 'tmi->enc_data.block' will
450 		 * contain the initialization vector that should have been
451 		 * passed in with the SETUP ioctl.
452 		 *
453 		 * V[n] = DES(V[n-1], key)
454 		 */
455 		if (!(tmi->enc_data.bytes % CFB_BLKSZ)) {
456 			int retval = 0;
457 			retval = kef_crypt(&tmi->enc_data,
458 					tmi->enc_data.block,
459 					CRYPTO_DATA_RAW,
460 					tmi->enc_data.blocklen,
461 					CRYPT_ENCRYPT);
462 
463 			if (retval != CRYPTO_SUCCESS) {
464 #ifdef DEBUG
465 				cmn_err(CE_WARN, "des_cfb_encrypt: kef_crypt "
466 					"failed - error 0x%0x", retval);
467 #endif
468 				mp->b_datap->db_type = M_ERROR;
469 				mp->b_rptr = mp->b_datap->db_base;
470 				*mp->b_rptr = EIO;
471 				mp->b_wptr = mp->b_rptr + sizeof (char);
472 				freemsg(mp->b_cont);
473 				mp->b_cont = NULL;
474 				qreply(WR(q), mp);
475 				return (NULL);
476 			}
477 		}
478 
479 		/* O[n] = I[n] ^ V[n] */
480 		*(optr++) = *(iptr++) ^
481 		    tmi->enc_data.block[tmi->enc_data.bytes % CFB_BLKSZ];
482 
483 		tmi->enc_data.bytes++;
484 		/*
485 		 * Feedback the encrypted output as the input to next DES call.
486 		 */
487 		if (!(tmi->enc_data.bytes % CFB_BLKSZ)) {
488 			char *dbptr = tmi->enc_data.block;
489 			/*
490 			 * Get the last bits of input from the previous
491 			 * msg block that we haven't yet used as feedback input.
492 			 */
493 			if (savedbytes > 0) {
494 				bcopy(tmi->enc_data.saveblock,
495 				    dbptr, (size_t)savedbytes);
496 				dbptr += savedbytes;
497 			}
498 
499 			/*
500 			 * Now copy the correct bytes from the current input
501 			 * stream and update the 'lastoutput' ptr
502 			 */
503 			bcopy(lastoutput, dbptr,
504 				(size_t)(CFB_BLKSZ - savedbytes));
505 
506 			lastoutput += (CFB_BLKSZ - savedbytes);
507 			savedbytes = 0;
508 		}
509 	}
510 	/*
511 	 * If there are bytes of input here that we need in the next
512 	 * block to build an ivec, save them off here.
513 	 */
514 	if (lastoutput < optr) {
515 		bcopy(lastoutput,
516 		    tmi->enc_data.saveblock + savedbytes,
517 		    (uint_t)(optr - lastoutput));
518 	}
519 	return (mp);
520 }
521 
522 /*
523  * des_cfb_decrypt
524  *
525  * Decrypt the data in the mblk using DES in Cipher Feedback mode
526  *
527  * # bytes in == # bytes out, no padding, confounding, or hashing
528  * is added.
529  *
530  */
531 static mblk_t *
532 des_cfb_decrypt(queue_t *q, struct tmodinfo *tmi, mblk_t *mp)
533 {
534 	uint_t len;
535 	uint_t savedbytes;
536 	char *iptr;
537 	char *lastinput;
538 	uint_t cp;
539 
540 	len = MBLKL(mp);
541 
542 	/* decrypted output goes into the new data buffer */
543 	lastinput = iptr = (char *)mp->b_rptr;
544 
545 	savedbytes = tmi->dec_data.bytes % tmi->dec_data.blocklen;
546 
547 	/*
548 	 * Save the input CFB_BLKSZ bytes at a time.
549 	 * We are trying to decrypt in-place, but need to keep
550 	 * a small sliding window of encrypted text to be
551 	 * used to construct the feedback buffer.
552 	 */
553 	cp = ((tmi->dec_data.blocklen - savedbytes) > len ? len :
554 		tmi->dec_data.blocklen - savedbytes);
555 
556 	bcopy(lastinput, tmi->dec_data.saveblock + savedbytes, cp);
557 	savedbytes += cp;
558 
559 	lastinput += cp;
560 
561 	while (iptr < (char *)mp->b_wptr) {
562 		/*
563 		 * Do DES-ECB.
564 		 * The first time this runs, the 'tmi->dec_data.block' will
565 		 * contain the initialization vector that should have been
566 		 * passed in with the SETUP ioctl.
567 		 */
568 		if (!(tmi->dec_data.bytes % CFB_BLKSZ)) {
569 			int retval;
570 			retval = kef_crypt(&tmi->dec_data,
571 					tmi->dec_data.block,
572 					CRYPTO_DATA_RAW,
573 					tmi->dec_data.blocklen,
574 					CRYPT_ENCRYPT);
575 
576 			if (retval != CRYPTO_SUCCESS) {
577 #ifdef DEBUG
578 				cmn_err(CE_WARN, "des_cfb_decrypt: kef_crypt "
579 					"failed - status 0x%0x", retval);
580 #endif
581 				mp->b_datap->db_type = M_ERROR;
582 				mp->b_rptr = mp->b_datap->db_base;
583 				*mp->b_rptr = EIO;
584 				mp->b_wptr = mp->b_rptr + sizeof (char);
585 				freemsg(mp->b_cont);
586 				mp->b_cont = NULL;
587 				qreply(WR(q), mp);
588 				return (NULL);
589 			}
590 		}
591 
592 		/*
593 		 * To decrypt, XOR the input with the output from the DES call
594 		 */
595 		*(iptr++) ^= tmi->dec_data.block[tmi->dec_data.bytes %
596 				CFB_BLKSZ];
597 
598 		tmi->dec_data.bytes++;
599 
600 		/*
601 		 * Feedback the encrypted input for next DES call.
602 		 */
603 		if (!(tmi->dec_data.bytes % tmi->dec_data.blocklen)) {
604 			char *dbptr = tmi->dec_data.block;
605 			/*
606 			 * Get the last bits of input from the previous block
607 			 * that we haven't yet processed.
608 			 */
609 			if (savedbytes > 0) {
610 				bcopy(tmi->dec_data.saveblock,
611 				    dbptr, savedbytes);
612 				dbptr += savedbytes;
613 			}
614 
615 			savedbytes = 0;
616 
617 			/*
618 			 * This block makes sure that our local
619 			 * buffer of input data is full and can
620 			 * be accessed from the beginning.
621 			 */
622 			if (lastinput < (char *)mp->b_wptr) {
623 
624 				/* How many bytes are left in the mblk? */
625 				cp = (((char *)mp->b_wptr - lastinput) >
626 					tmi->dec_data.blocklen ?
627 					tmi->dec_data.blocklen :
628 					(char *)mp->b_wptr - lastinput);
629 
630 				/* copy what we need */
631 				bcopy(lastinput, tmi->dec_data.saveblock,
632 					cp);
633 
634 				lastinput += cp;
635 				savedbytes = cp;
636 			}
637 		}
638 	}
639 
640 	return (mp);
641 }
642 
643 /*
644  * crc32_calc
645  *
646  * Compute a CRC32 checksum on the input
647  */
648 static int
649 crc32_calc(uchar_t *buf, uchar_t *input, uint_t len)
650 {
651 	uint32_t crc;
652 
653 	CRC32(crc, input, len, 0, crc32_table);
654 
655 	buf[0] = (uchar_t)(crc & 0xff);
656 	buf[1] = (uchar_t)((crc >> 8) & 0xff);
657 	buf[2] = (uchar_t)((crc >> 16) & 0xff);
658 	buf[3] = (uchar_t)((crc >> 24) & 0xff);
659 
660 	return (CRYPTO_SUCCESS);
661 }
662 
663 static int
664 kef_digest(crypto_mech_type_t digest_type,
665 	uchar_t *input, uint_t inlen,
666 	uchar_t *output, uint_t hashlen)
667 {
668 	iovec_t v1, v2;
669 	crypto_data_t d1, d2;
670 	crypto_mechanism_t mech;
671 	int rv;
672 
673 	mech.cm_type = digest_type;
674 	mech.cm_param = 0;
675 	mech.cm_param_len = 0;
676 
677 	v1.iov_base = (void *)input;
678 	v1.iov_len = inlen;
679 
680 	d1.cd_format = CRYPTO_DATA_RAW;
681 	d1.cd_offset = 0;
682 	d1.cd_length = v1.iov_len;
683 	d1.cd_raw = v1;
684 
685 	v2.iov_base = (void *)output;
686 	v2.iov_len = hashlen;
687 
688 	d2.cd_format = CRYPTO_DATA_RAW;
689 	d2.cd_offset = 0;
690 	d2.cd_length = v2.iov_len;
691 	d2.cd_raw = v2;
692 
693 	rv = crypto_digest(&mech, &d1, &d2, NULL);
694 
695 	return (rv);
696 }
697 
698 /*
699  * sha1_calc
700  *
701  * Get a SHA1 hash on the input data.
702  */
703 static int
704 sha1_calc(uchar_t *output, uchar_t *input, uint_t inlen)
705 {
706 	int rv;
707 
708 	rv = kef_digest(sha1_hash_mech, input, inlen, output, SHA1_HASHSIZE);
709 
710 	return (rv);
711 }
712 
713 /*
714  * Get an MD5 hash on the input data.
715  * md5_calc
716  *
717  */
718 static int
719 md5_calc(uchar_t *output, uchar_t *input, uint_t inlen)
720 {
721 	int rv;
722 
723 	rv = kef_digest(md5_hash_mech, input, inlen, output, MD5_HASHSIZE);
724 
725 	return (rv);
726 }
727 
728 /*
729  * nfold
730  * duplicate the functionality of the krb5_nfold function from
731  * the userland kerberos mech.
732  * This is needed to derive keys for use with 3DES/SHA1-HMAC
733  * ciphers.
734  */
735 static void
736 nfold(int inbits, uchar_t *in, int outbits, uchar_t *out)
737 {
738 	int a, b, c, lcm;
739 	int byte, i, msbit;
740 
741 	inbits >>= 3;
742 	outbits >>= 3;
743 
744 	/* first compute lcm(n,k) */
745 	a = outbits;
746 	b = inbits;
747 
748 	while (b != 0) {
749 		c = b;
750 		b = a%b;
751 		a = c;
752 	}
753 
754 	lcm = outbits*inbits/a;
755 
756 	/* now do the real work */
757 
758 	bzero(out, outbits);
759 	byte = 0;
760 
761 	/*
762 	 * Compute the msbit in k which gets added into this byte
763 	 * first, start with the msbit in the first, unrotated byte
764 	 * then, for each byte, shift to the right for each repetition
765 	 * last, pick out the correct byte within that shifted repetition
766 	 */
767 	for (i = lcm-1; i >= 0; i--) {
768 		msbit = (((inbits<<3)-1)
769 			+(((inbits<<3)+13)*(i/inbits))
770 			+((inbits-(i%inbits))<<3)) %(inbits<<3);
771 
772 		/* pull out the byte value itself */
773 		byte += (((in[((inbits-1)-(msbit>>3))%inbits]<<8)|
774 			(in[((inbits)-(msbit>>3))%inbits]))
775 			>>((msbit&7)+1))&0xff;
776 
777 		/* do the addition */
778 		byte += out[i%outbits];
779 		out[i%outbits] = byte&0xff;
780 
781 		byte >>= 8;
782 	}
783 
784 	/* if there's a carry bit left over, add it back in */
785 	if (byte) {
786 		for (i = outbits-1; i >= 0; i--) {
787 			/* do the addition */
788 			byte += out[i];
789 			out[i] = byte&0xff;
790 
791 			/* keep around the carry bit, if any */
792 			byte >>= 8;
793 		}
794 	}
795 }
796 
797 #define	smask(step) ((1<<step)-1)
798 #define	pstep(x, step) (((x)&smask(step))^(((x)>>step)&smask(step)))
799 #define	parity_char(x) pstep(pstep(pstep((x), 4), 2), 1)
800 
801 /*
802  * Duplicate the functionality of the "dk_derive_key" function
803  * in the Kerberos mechanism.
804  */
805 static int
806 derive_key(struct cipher_data_t *cdata, uchar_t *constdata,
807 	int constlen, char *dkey, int keybytes,
808 	int blocklen)
809 {
810 	int rv = 0;
811 	int n = 0, i;
812 	char *inblock;
813 	char *rawkey;
814 	char *zeroblock;
815 	char *saveblock;
816 
817 	inblock = kmem_zalloc(blocklen, KM_SLEEP);
818 	rawkey = kmem_zalloc(keybytes, KM_SLEEP);
819 	zeroblock = kmem_zalloc(blocklen, KM_SLEEP);
820 
821 	if (constlen == blocklen)
822 		bcopy(constdata, inblock, blocklen);
823 	else
824 		nfold(constlen * 8, constdata,
825 			blocklen * 8, (uchar_t *)inblock);
826 
827 	/*
828 	 * zeroblock is an IV of all 0's.
829 	 *
830 	 * The "block" section of the cdata record is used as the
831 	 * IV for crypto operations in the kef_crypt function.
832 	 *
833 	 * We use 'block' as a generic IV data buffer because it
834 	 * is attached to the stream state data and thus can
835 	 * be used to hold information that must carry over
836 	 * from processing of one mblk to another.
837 	 *
838 	 * Here, we save the current IV and replace it with
839 	 * and empty IV (all 0's) for use when deriving the
840 	 * keys.  Once the key derivation is done, we swap the
841 	 * old IV back into place.
842 	 */
843 	saveblock = cdata->block;
844 	cdata->block = zeroblock;
845 
846 	while (n < keybytes) {
847 		rv = kef_crypt(cdata, inblock, CRYPTO_DATA_RAW,
848 				blocklen, CRYPT_ENCRYPT);
849 		if (rv != CRYPTO_SUCCESS) {
850 			/* put the original IV block back in place */
851 			cdata->block = saveblock;
852 			cmn_err(CE_WARN, "failed to derive a key: %0x", rv);
853 			goto cleanup;
854 		}
855 
856 		if (keybytes - n < blocklen) {
857 			bcopy(inblock, rawkey+n, (keybytes-n));
858 			break;
859 		}
860 		bcopy(inblock, rawkey+n, blocklen);
861 		n += blocklen;
862 	}
863 	/* put the original IV block back in place */
864 	cdata->block = saveblock;
865 
866 	/* finally, make the key */
867 	if (cdata->method == CRYPT_METHOD_DES3_CBC_SHA1) {
868 		/*
869 		 * 3DES key derivation requires that we make sure the
870 		 * key has the proper parity.
871 		 */
872 		for (i = 0; i < 3; i++) {
873 			bcopy(rawkey+(i*7), dkey+(i*8), 7);
874 
875 			/* 'dkey' is our derived key output buffer */
876 			dkey[i*8+7] = (((dkey[i*8]&1)<<1) |
877 					((dkey[i*8+1]&1)<<2) |
878 					((dkey[i*8+2]&1)<<3) |
879 					((dkey[i*8+3]&1)<<4) |
880 					((dkey[i*8+4]&1)<<5) |
881 					((dkey[i*8+5]&1)<<6) |
882 					((dkey[i*8+6]&1)<<7));
883 
884 			for (n = 0; n < 8; n++) {
885 				dkey[i*8 + n] &=  0xfe;
886 				dkey[i*8 + n] |= 1^parity_char(dkey[i*8 + n]);
887 			}
888 		}
889 	} else if (IS_AES_METHOD(cdata->method)) {
890 		bcopy(rawkey, dkey, keybytes);
891 	}
892 cleanup:
893 	kmem_free(inblock, blocklen);
894 	kmem_free(zeroblock, blocklen);
895 	kmem_free(rawkey, keybytes);
896 	return (rv);
897 }
898 
899 /*
900  * create_derived_keys
901  *
902  * Algorithm for deriving a new key and an HMAC key
903  * before computing the 3DES-SHA1-HMAC operation on the plaintext
904  * This algorithm matches the work done by Kerberos mechanism
905  * in userland.
906  */
907 static int
908 create_derived_keys(struct cipher_data_t *cdata, uint32_t usage,
909 		crypto_key_t *enckey, crypto_key_t *hmackey)
910 {
911 	uchar_t constdata[K5CLENGTH];
912 	int keybytes;
913 	int rv;
914 
915 	constdata[0] = (usage>>24)&0xff;
916 	constdata[1] = (usage>>16)&0xff;
917 	constdata[2] = (usage>>8)&0xff;
918 	constdata[3] = usage & 0xff;
919 	/* Use "0xAA" for deriving encryption key */
920 	constdata[4] = 0xAA; /* from MIT Kerberos code */
921 
922 	enckey->ck_length = cdata->keylen * 8;
923 	enckey->ck_format = CRYPTO_KEY_RAW;
924 	enckey->ck_data = kmem_zalloc(cdata->keylen, KM_SLEEP);
925 
926 	switch (cdata->method) {
927 		case CRYPT_METHOD_DES_CFB:
928 		case CRYPT_METHOD_DES_CBC_NULL:
929 		case CRYPT_METHOD_DES_CBC_MD5:
930 		case CRYPT_METHOD_DES_CBC_CRC:
931 			keybytes = 8;
932 			break;
933 		case CRYPT_METHOD_DES3_CBC_SHA1:
934 			keybytes = CRYPT_DES3_KEYBYTES;
935 			break;
936 		case CRYPT_METHOD_ARCFOUR_HMAC_MD5:
937 		case CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP:
938 			keybytes = CRYPT_ARCFOUR_KEYBYTES;
939 			break;
940 		case CRYPT_METHOD_AES128:
941 			keybytes = CRYPT_AES128_KEYBYTES;
942 			break;
943 		case CRYPT_METHOD_AES256:
944 			keybytes = CRYPT_AES256_KEYBYTES;
945 			break;
946 	}
947 
948 	/* derive main crypto key */
949 	rv = derive_key(cdata, constdata, sizeof (constdata),
950 		enckey->ck_data, keybytes, cdata->blocklen);
951 
952 	if (rv == CRYPTO_SUCCESS) {
953 
954 		/* Use "0x55" for deriving mac key */
955 		constdata[4] = 0x55;
956 
957 		hmackey->ck_length = cdata->keylen * 8;
958 		hmackey->ck_format = CRYPTO_KEY_RAW;
959 		hmackey->ck_data = kmem_zalloc(cdata->keylen, KM_SLEEP);
960 
961 		rv = derive_key(cdata, constdata, sizeof (constdata),
962 				hmackey->ck_data, keybytes,
963 				cdata->blocklen);
964 	} else {
965 		cmn_err(CE_WARN, "failed to derive crypto key: %02x", rv);
966 	}
967 
968 	return (rv);
969 }
970 
971 /*
972  * Compute 3-DES crypto and HMAC.
973  */
974 static int
975 kef_decr_hmac(struct cipher_data_t *cdata,
976 	mblk_t *mp, int length,
977 	char *hmac, int hmaclen)
978 {
979 	int rv = CRYPTO_FAILED;
980 
981 	crypto_mechanism_t encr_mech;
982 	crypto_mechanism_t mac_mech;
983 	crypto_data_t dd;
984 	crypto_data_t mac;
985 	iovec_t v1;
986 
987 	ASSERT(cdata != NULL);
988 	ASSERT(mp != NULL);
989 	ASSERT(hmac != NULL);
990 
991 	bzero(&dd, sizeof (dd));
992 	dd.cd_format = CRYPTO_DATA_MBLK;
993 	dd.cd_offset = 0;
994 	dd.cd_length = length;
995 	dd.cd_mp = mp;
996 
997 	v1.iov_base = hmac;
998 	v1.iov_len = hmaclen;
999 
1000 	mac.cd_format = CRYPTO_DATA_RAW;
1001 	mac.cd_offset = 0;
1002 	mac.cd_length = hmaclen;
1003 	mac.cd_raw = v1;
1004 
1005 	/*
1006 	 * cdata->block holds the IVEC
1007 	 */
1008 	encr_mech.cm_type = cdata->mech_type;
1009 	encr_mech.cm_param = cdata->block;
1010 
1011 	if (cdata->block != NULL)
1012 		encr_mech.cm_param_len = cdata->blocklen;
1013 	else
1014 		encr_mech.cm_param_len = 0;
1015 
1016 	rv = crypto_decrypt(&encr_mech, &dd, &cdata->d_encr_key,
1017 			cdata->enc_tmpl, NULL, NULL);
1018 	if (rv != CRYPTO_SUCCESS) {
1019 		cmn_err(CE_WARN, "crypto_decrypt failed: %0x", rv);
1020 		return (rv);
1021 	}
1022 
1023 	mac_mech.cm_type = sha1_hmac_mech;
1024 	mac_mech.cm_param = NULL;
1025 	mac_mech.cm_param_len = 0;
1026 
1027 	/*
1028 	 * Compute MAC of the plaintext decrypted above.
1029 	 */
1030 	rv = crypto_mac(&mac_mech, &dd, &cdata->d_hmac_key,
1031 			cdata->hmac_tmpl, &mac, NULL);
1032 
1033 	if (rv != CRYPTO_SUCCESS) {
1034 		cmn_err(CE_WARN, "crypto_mac failed: %0x", rv);
1035 	}
1036 
1037 	return (rv);
1038 }
1039 
1040 /*
1041  * Compute 3-DES crypto and HMAC.
1042  */
1043 static int
1044 kef_encr_hmac(struct cipher_data_t *cdata,
1045 	mblk_t *mp, int length,
1046 	char *hmac, int hmaclen)
1047 {
1048 	int rv = CRYPTO_FAILED;
1049 
1050 	crypto_mechanism_t encr_mech;
1051 	crypto_mechanism_t mac_mech;
1052 	crypto_data_t dd;
1053 	crypto_data_t mac;
1054 	iovec_t v1;
1055 
1056 	ASSERT(cdata != NULL);
1057 	ASSERT(mp != NULL);
1058 	ASSERT(hmac != NULL);
1059 
1060 	bzero(&dd, sizeof (dd));
1061 	dd.cd_format = CRYPTO_DATA_MBLK;
1062 	dd.cd_offset = 0;
1063 	dd.cd_length = length;
1064 	dd.cd_mp = mp;
1065 
1066 	v1.iov_base = hmac;
1067 	v1.iov_len = hmaclen;
1068 
1069 	mac.cd_format = CRYPTO_DATA_RAW;
1070 	mac.cd_offset = 0;
1071 	mac.cd_length = hmaclen;
1072 	mac.cd_raw = v1;
1073 
1074 	/*
1075 	 * cdata->block holds the IVEC
1076 	 */
1077 	encr_mech.cm_type = cdata->mech_type;
1078 	encr_mech.cm_param = cdata->block;
1079 
1080 	if (cdata->block != NULL)
1081 		encr_mech.cm_param_len = cdata->blocklen;
1082 	else
1083 		encr_mech.cm_param_len = 0;
1084 
1085 	mac_mech.cm_type = sha1_hmac_mech;
1086 	mac_mech.cm_param = NULL;
1087 	mac_mech.cm_param_len = 0;
1088 
1089 	rv = crypto_mac(&mac_mech, &dd, &cdata->d_hmac_key,
1090 			cdata->hmac_tmpl, &mac, NULL);
1091 
1092 	if (rv != CRYPTO_SUCCESS) {
1093 		cmn_err(CE_WARN, "crypto_mac failed: %0x", rv);
1094 		return (rv);
1095 	}
1096 
1097 	rv = crypto_encrypt(&encr_mech, &dd, &cdata->d_encr_key,
1098 			cdata->enc_tmpl, NULL, NULL);
1099 	if (rv != CRYPTO_SUCCESS) {
1100 		cmn_err(CE_WARN, "crypto_encrypt failed: %0x", rv);
1101 	}
1102 
1103 	return (rv);
1104 }
1105 
1106 /*
1107  * kef_crypt
1108  *
1109  * Use the Kernel encryption framework to provide the
1110  * crypto operations for the indicated data.
1111  */
1112 static int
1113 kef_crypt(struct cipher_data_t *cdata,
1114 	void *indata, crypto_data_format_t fmt,
1115 	size_t length, int mode)
1116 {
1117 	int rv = CRYPTO_FAILED;
1118 
1119 	crypto_mechanism_t mech;
1120 	crypto_key_t crkey;
1121 	iovec_t v1;
1122 	crypto_data_t d1;
1123 
1124 	ASSERT(cdata != NULL);
1125 	ASSERT(indata != NULL);
1126 	ASSERT(fmt == CRYPTO_DATA_RAW || fmt == CRYPTO_DATA_MBLK);
1127 
1128 	bzero(&crkey, sizeof (crkey));
1129 	bzero(&d1, sizeof (d1));
1130 
1131 	crkey.ck_format = CRYPTO_KEY_RAW;
1132 	crkey.ck_data =  cdata->key;
1133 
1134 	/* keys are measured in bits, not bytes, so multiply by 8 */
1135 	crkey.ck_length = cdata->keylen * 8;
1136 
1137 	if (fmt == CRYPTO_DATA_RAW) {
1138 		v1.iov_base = (char *)indata;
1139 		v1.iov_len = length;
1140 	}
1141 
1142 	d1.cd_format = fmt;
1143 	d1.cd_offset = 0;
1144 	d1.cd_length = length;
1145 	if (fmt == CRYPTO_DATA_RAW)
1146 		d1.cd_raw = v1;
1147 	else if (fmt == CRYPTO_DATA_MBLK)
1148 		d1.cd_mp = (mblk_t *)indata;
1149 
1150 	mech.cm_type = cdata->mech_type;
1151 	mech.cm_param = cdata->block;
1152 	/*
1153 	 * cdata->block holds the IVEC
1154 	 */
1155 	if (cdata->block != NULL)
1156 		mech.cm_param_len = cdata->blocklen;
1157 	else
1158 		mech.cm_param_len = 0;
1159 
1160 	/*
1161 	 * encrypt and decrypt in-place
1162 	 */
1163 	if (mode == CRYPT_ENCRYPT)
1164 		rv = crypto_encrypt(&mech, &d1, &crkey, NULL, NULL, NULL);
1165 	else
1166 		rv = crypto_decrypt(&mech, &d1, &crkey, NULL, NULL, NULL);
1167 
1168 	if (rv != CRYPTO_SUCCESS) {
1169 		cmn_err(CE_WARN, "%s returned error %08x",
1170 			(mode == CRYPT_ENCRYPT ? "crypto_encrypt" :
1171 				"crypto_decrypt"), rv);
1172 		return (CRYPTO_FAILED);
1173 	}
1174 
1175 	return (rv);
1176 }
1177 
1178 static int
1179 do_hmac(crypto_mech_type_t mech,
1180 	crypto_key_t *key,
1181 	char *data, int datalen,
1182 	char *hmac, int hmaclen)
1183 {
1184 	int rv = 0;
1185 	crypto_mechanism_t mac_mech;
1186 	crypto_data_t dd;
1187 	crypto_data_t mac;
1188 	iovec_t vdata, vmac;
1189 
1190 	mac_mech.cm_type = mech;
1191 	mac_mech.cm_param = NULL;
1192 	mac_mech.cm_param_len = 0;
1193 
1194 	vdata.iov_base = data;
1195 	vdata.iov_len = datalen;
1196 
1197 	bzero(&dd, sizeof (dd));
1198 	dd.cd_format = CRYPTO_DATA_RAW;
1199 	dd.cd_offset = 0;
1200 	dd.cd_length = datalen;
1201 	dd.cd_raw = vdata;
1202 
1203 	vmac.iov_base = hmac;
1204 	vmac.iov_len = hmaclen;
1205 
1206 	mac.cd_format = CRYPTO_DATA_RAW;
1207 	mac.cd_offset = 0;
1208 	mac.cd_length = hmaclen;
1209 	mac.cd_raw = vmac;
1210 
1211 	/*
1212 	 * Compute MAC of the plaintext decrypted above.
1213 	 */
1214 	rv = crypto_mac(&mac_mech, &dd, key, NULL, &mac, NULL);
1215 
1216 	if (rv != CRYPTO_SUCCESS) {
1217 		cmn_err(CE_WARN, "crypto_mac failed: %0x", rv);
1218 	}
1219 
1220 	return (rv);
1221 }
1222 
1223 #define	XOR_BLOCK(src, dst) \
1224 	(dst)[0] ^= (src)[0]; \
1225 	(dst)[1] ^= (src)[1]; \
1226 	(dst)[2] ^= (src)[2]; \
1227 	(dst)[3] ^= (src)[3]; \
1228 	(dst)[4] ^= (src)[4]; \
1229 	(dst)[5] ^= (src)[5]; \
1230 	(dst)[6] ^= (src)[6]; \
1231 	(dst)[7] ^= (src)[7]; \
1232 	(dst)[8] ^= (src)[8]; \
1233 	(dst)[9] ^= (src)[9]; \
1234 	(dst)[10] ^= (src)[10]; \
1235 	(dst)[11] ^= (src)[11]; \
1236 	(dst)[12] ^= (src)[12]; \
1237 	(dst)[13] ^= (src)[13]; \
1238 	(dst)[14] ^= (src)[14]; \
1239 	(dst)[15] ^= (src)[15]
1240 
1241 #define	xorblock(x, y) XOR_BLOCK(y, x)
1242 
1243 static int
1244 aes_cbc_cts_encrypt(struct tmodinfo *tmi, uchar_t *plain, size_t length)
1245 {
1246 	int result = CRYPTO_SUCCESS;
1247 	unsigned char tmp[DEFAULT_AES_BLOCKLEN];
1248 	unsigned char tmp2[DEFAULT_AES_BLOCKLEN];
1249 	unsigned char tmp3[DEFAULT_AES_BLOCKLEN];
1250 	int nblocks = 0, blockno;
1251 	crypto_data_t ct, pt;
1252 	crypto_mechanism_t mech;
1253 
1254 	mech.cm_type = tmi->enc_data.mech_type;
1255 	if (tmi->enc_data.ivlen > 0 && tmi->enc_data.ivec != NULL) {
1256 		bcopy(tmi->enc_data.ivec, tmp, DEFAULT_AES_BLOCKLEN);
1257 	} else {
1258 		bzero(tmp, sizeof (tmp));
1259 	}
1260 	mech.cm_param = NULL;
1261 	mech.cm_param_len = 0;
1262 
1263 	nblocks = (length + DEFAULT_AES_BLOCKLEN - 1) / DEFAULT_AES_BLOCKLEN;
1264 
1265 	bzero(&ct, sizeof (crypto_data_t));
1266 	bzero(&pt, sizeof (crypto_data_t));
1267 
1268 	if (nblocks == 1) {
1269 		pt.cd_format = CRYPTO_DATA_RAW;
1270 		pt.cd_length = length;
1271 		pt.cd_raw.iov_base = (char *)plain;
1272 		pt.cd_raw.iov_len = length;
1273 
1274 		result = crypto_encrypt(&mech, &pt,
1275 			&tmi->enc_data.d_encr_key, NULL, NULL, NULL);
1276 
1277 		if (result != CRYPTO_SUCCESS) {
1278 			cmn_err(CE_WARN, "aes_cbc_cts_encrypt: "
1279 				"crypto_encrypt failed: %0x", result);
1280 		}
1281 	} else {
1282 		size_t nleft;
1283 
1284 		ct.cd_format = CRYPTO_DATA_RAW;
1285 		ct.cd_offset = 0;
1286 		ct.cd_length = DEFAULT_AES_BLOCKLEN;
1287 
1288 		pt.cd_format = CRYPTO_DATA_RAW;
1289 		pt.cd_offset = 0;
1290 		pt.cd_length = DEFAULT_AES_BLOCKLEN;
1291 
1292 		result = crypto_encrypt_init(&mech,
1293 				&tmi->enc_data.d_encr_key,
1294 				tmi->enc_data.enc_tmpl,
1295 				&tmi->enc_data.ctx, NULL);
1296 
1297 		if (result != CRYPTO_SUCCESS) {
1298 			cmn_err(CE_WARN, "aes_cbc_cts_encrypt: "
1299 				"crypto_encrypt_init failed: %0x", result);
1300 			goto cleanup;
1301 		}
1302 
1303 		for (blockno = 0; blockno < nblocks - 2; blockno++) {
1304 			xorblock(tmp, plain + blockno * DEFAULT_AES_BLOCKLEN);
1305 
1306 			pt.cd_raw.iov_base = (char *)tmp;
1307 			pt.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1308 
1309 			ct.cd_raw.iov_base = (char *)plain +
1310 				blockno * DEFAULT_AES_BLOCKLEN;
1311 			ct.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1312 
1313 			result = crypto_encrypt_update(tmi->enc_data.ctx,
1314 					&pt, &ct, NULL);
1315 
1316 			if (result != CRYPTO_SUCCESS) {
1317 				cmn_err(CE_WARN, "aes_cbc_cts_encrypt: "
1318 					"crypto_encrypt_update failed: %0x",
1319 					result);
1320 				goto cleanup;
1321 			}
1322 			/* copy result over original bytes */
1323 			/* make another copy for the next XOR step */
1324 			bcopy(plain + blockno * DEFAULT_AES_BLOCKLEN,
1325 				tmp, DEFAULT_AES_BLOCKLEN);
1326 		}
1327 		/* XOR cipher text from n-3 with plain text from n-2 */
1328 		xorblock(tmp, plain + (nblocks - 2) * DEFAULT_AES_BLOCKLEN);
1329 
1330 		pt.cd_raw.iov_base = (char *)tmp;
1331 		pt.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1332 
1333 		ct.cd_raw.iov_base = (char *)tmp2;
1334 		ct.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1335 
1336 		/* encrypt XOR-ed block N-2 */
1337 		result = crypto_encrypt_update(tmi->enc_data.ctx,
1338 				&pt, &ct, NULL);
1339 		if (result != CRYPTO_SUCCESS) {
1340 			cmn_err(CE_WARN, "aes_cbc_cts_encrypt: "
1341 				"crypto_encrypt_update(2) failed: %0x",
1342 				result);
1343 			goto cleanup;
1344 		}
1345 		nleft = length - (nblocks - 1) * DEFAULT_AES_BLOCKLEN;
1346 
1347 		bzero(tmp3, sizeof (tmp3));
1348 		/* Save final plaintext bytes from n-1 */
1349 		bcopy(plain + (nblocks - 1) * DEFAULT_AES_BLOCKLEN, tmp3,
1350 			nleft);
1351 
1352 		/* Overwrite n-1 with cipher text from n-2 */
1353 		bcopy(tmp2, plain + (nblocks - 1) * DEFAULT_AES_BLOCKLEN,
1354 			nleft);
1355 
1356 		bcopy(tmp2, tmp, DEFAULT_AES_BLOCKLEN);
1357 		/* XOR cipher text from n-1 with plain text from n-1 */
1358 		xorblock(tmp, tmp3);
1359 
1360 		pt.cd_raw.iov_base = (char *)tmp;
1361 		pt.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1362 
1363 		ct.cd_raw.iov_base = (char *)tmp2;
1364 		ct.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1365 
1366 		/* encrypt block N-2 */
1367 		result = crypto_encrypt_update(tmi->enc_data.ctx,
1368 			&pt, &ct, NULL);
1369 
1370 		if (result != CRYPTO_SUCCESS) {
1371 			cmn_err(CE_WARN, "aes_cbc_cts_encrypt: "
1372 				"crypto_encrypt_update(3) failed: %0x",
1373 				result);
1374 			goto cleanup;
1375 		}
1376 
1377 		bcopy(tmp2, plain + (nblocks - 2) * DEFAULT_AES_BLOCKLEN,
1378 			DEFAULT_AES_BLOCKLEN);
1379 
1380 
1381 		ct.cd_raw.iov_base = (char *)tmp2;
1382 		ct.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1383 
1384 		/*
1385 		 * Ignore the output on the final step.
1386 		 */
1387 		result = crypto_encrypt_final(tmi->enc_data.ctx, &ct, NULL);
1388 		if (result != CRYPTO_SUCCESS) {
1389 			cmn_err(CE_WARN, "aes_cbc_cts_encrypt: "
1390 				"crypto_encrypt_final(3) failed: %0x",
1391 				result);
1392 		}
1393 		tmi->enc_data.ctx = NULL;
1394 	}
1395 cleanup:
1396 	bzero(tmp, sizeof (tmp));
1397 	bzero(tmp2, sizeof (tmp));
1398 	bzero(tmp3, sizeof (tmp));
1399 	bzero(tmi->enc_data.block, tmi->enc_data.blocklen);
1400 	return (result);
1401 }
1402 
1403 static int
1404 aes_cbc_cts_decrypt(struct tmodinfo *tmi, uchar_t *buff, size_t length)
1405 {
1406 	int result = CRYPTO_SUCCESS;
1407 	unsigned char tmp[DEFAULT_AES_BLOCKLEN];
1408 	unsigned char tmp2[DEFAULT_AES_BLOCKLEN];
1409 	unsigned char tmp3[DEFAULT_AES_BLOCKLEN];
1410 	int nblocks = 0, blockno;
1411 	crypto_data_t ct, pt;
1412 	crypto_mechanism_t mech;
1413 
1414 	mech.cm_type = tmi->enc_data.mech_type;
1415 
1416 	if (tmi->dec_data.ivec_usage != IVEC_NEVER &&
1417 	    tmi->dec_data.ivlen > 0 && tmi->dec_data.ivec != NULL) {
1418 		bcopy(tmi->dec_data.ivec, tmp, DEFAULT_AES_BLOCKLEN);
1419 	} else {
1420 		bzero(tmp, sizeof (tmp));
1421 	}
1422 	mech.cm_param_len = 0;
1423 	mech.cm_param = NULL;
1424 
1425 	nblocks = (length + DEFAULT_AES_BLOCKLEN - 1) / DEFAULT_AES_BLOCKLEN;
1426 
1427 	bzero(&pt, sizeof (pt));
1428 	bzero(&ct, sizeof (ct));
1429 
1430 	if (nblocks == 1) {
1431 		ct.cd_format = CRYPTO_DATA_RAW;
1432 		ct.cd_length = length;
1433 		ct.cd_raw.iov_base = (char *)buff;
1434 		ct.cd_raw.iov_len = length;
1435 
1436 		result = crypto_decrypt(&mech, &ct,
1437 			&tmi->dec_data.d_encr_key, NULL, NULL, NULL);
1438 
1439 		if (result != CRYPTO_SUCCESS) {
1440 			cmn_err(CE_WARN, "aes_cbc_cts_decrypt: "
1441 				"crypto_decrypt failed: %0x", result);
1442 			goto cleanup;
1443 		}
1444 	} else {
1445 		ct.cd_format = CRYPTO_DATA_RAW;
1446 		ct.cd_offset = 0;
1447 		ct.cd_length = DEFAULT_AES_BLOCKLEN;
1448 
1449 		pt.cd_format = CRYPTO_DATA_RAW;
1450 		pt.cd_offset = 0;
1451 		pt.cd_length = DEFAULT_AES_BLOCKLEN;
1452 
1453 		result = crypto_decrypt_init(&mech,
1454 				&tmi->dec_data.d_encr_key,
1455 				tmi->dec_data.enc_tmpl,
1456 				&tmi->dec_data.ctx, NULL);
1457 
1458 		if (result != CRYPTO_SUCCESS) {
1459 			cmn_err(CE_WARN, "aes_cbc_cts_decrypt: "
1460 				"crypto_decrypt_init failed: %0x", result);
1461 			goto cleanup;
1462 		}
1463 		for (blockno = 0; blockno < nblocks - 2; blockno++) {
1464 			ct.cd_raw.iov_base = (char *)buff +
1465 				(blockno * DEFAULT_AES_BLOCKLEN);
1466 			ct.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1467 
1468 			pt.cd_raw.iov_base = (char *)tmp2;
1469 			pt.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1470 
1471 			/*
1472 			 * Save the input to the decrypt so it can
1473 			 * be used later for an XOR operation
1474 			 */
1475 			bcopy(buff + (blockno * DEFAULT_AES_BLOCKLEN),
1476 				tmi->dec_data.block, DEFAULT_AES_BLOCKLEN);
1477 
1478 			result = crypto_decrypt_update(tmi->dec_data.ctx,
1479 					&ct, &pt, NULL);
1480 			if (result != CRYPTO_SUCCESS) {
1481 				cmn_err(CE_WARN, "aes_cbc_cts_decrypt: "
1482 					"crypto_decrypt_update(1) error - "
1483 					"result = 0x%08x", result);
1484 				goto cleanup;
1485 			}
1486 			xorblock(tmp2, tmp);
1487 			bcopy(tmp2, buff + blockno * DEFAULT_AES_BLOCKLEN,
1488 				DEFAULT_AES_BLOCKLEN);
1489 			/*
1490 			 * The original cipher text is used as the xor
1491 			 * for the next block, save it here.
1492 			 */
1493 			bcopy(tmi->dec_data.block, tmp, DEFAULT_AES_BLOCKLEN);
1494 		}
1495 		ct.cd_raw.iov_base = (char *)buff +
1496 			((nblocks - 2) * DEFAULT_AES_BLOCKLEN);
1497 		ct.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1498 		pt.cd_raw.iov_base = (char *)tmp2;
1499 		pt.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1500 
1501 		result = crypto_decrypt_update(tmi->dec_data.ctx,
1502 				&ct, &pt, NULL);
1503 		if (result != CRYPTO_SUCCESS) {
1504 			cmn_err(CE_WARN,
1505 				"aes_cbc_cts_decrypt: "
1506 				"crypto_decrypt_update(2) error -"
1507 				" result = 0x%08x", result);
1508 			goto cleanup;
1509 		}
1510 		bzero(tmp3, sizeof (tmp3));
1511 		bcopy(buff + (nblocks - 1) * DEFAULT_AES_BLOCKLEN, tmp3,
1512 			length - ((nblocks - 1) * DEFAULT_AES_BLOCKLEN));
1513 
1514 		xorblock(tmp2, tmp3);
1515 		bcopy(tmp2, buff + (nblocks - 1) * DEFAULT_AES_BLOCKLEN,
1516 			length - ((nblocks - 1) * DEFAULT_AES_BLOCKLEN));
1517 
1518 		/* 2nd to last block ... */
1519 		bcopy(tmp3, tmp2,
1520 			length - ((nblocks - 1) * DEFAULT_AES_BLOCKLEN));
1521 
1522 		ct.cd_raw.iov_base = (char *)tmp2;
1523 		ct.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1524 		pt.cd_raw.iov_base = (char *)tmp3;
1525 		pt.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1526 
1527 		result = crypto_decrypt_update(tmi->dec_data.ctx,
1528 				&ct, &pt, NULL);
1529 		if (result != CRYPTO_SUCCESS) {
1530 			cmn_err(CE_WARN,
1531 				"aes_cbc_cts_decrypt: "
1532 				"crypto_decrypt_update(3) error - "
1533 				"result = 0x%08x", result);
1534 			goto cleanup;
1535 		}
1536 		xorblock(tmp3, tmp);
1537 
1538 
1539 		/* Finally, update the 2nd to last block and we are done. */
1540 		bcopy(tmp3, buff + (nblocks - 2) * DEFAULT_AES_BLOCKLEN,
1541 			DEFAULT_AES_BLOCKLEN);
1542 
1543 		/* Do Final step, but ignore output */
1544 		pt.cd_raw.iov_base = (char *)tmp2;
1545 		pt.cd_raw.iov_len = DEFAULT_AES_BLOCKLEN;
1546 		result = crypto_decrypt_final(tmi->dec_data.ctx, &pt, NULL);
1547 		if (result != CRYPTO_SUCCESS) {
1548 			cmn_err(CE_WARN, "aes_cbc_cts_decrypt: "
1549 				"crypto_decrypt_final error - "
1550 				"result = 0x%0x", result);
1551 		}
1552 		tmi->dec_data.ctx = NULL;
1553 	}
1554 
1555 cleanup:
1556 	bzero(tmp, sizeof (tmp));
1557 	bzero(tmp2, sizeof (tmp));
1558 	bzero(tmp3, sizeof (tmp));
1559 	bzero(tmi->dec_data.block, tmi->dec_data.blocklen);
1560 	return (result);
1561 }
1562 
1563 /*
1564  * AES decrypt
1565  *
1566  * format of ciphertext when using AES
1567  *  +-------------+------------+------------+
1568  *  |  confounder | msg-data   |  hmac      |
1569  *  +-------------+------------+------------+
1570  */
1571 static mblk_t *
1572 aes_decrypt(queue_t *q, struct tmodinfo *tmi, mblk_t *mp,
1573 	hash_info_t *hash)
1574 {
1575 	int result;
1576 	size_t enclen;
1577 	size_t inlen;
1578 	uchar_t hmacbuff[64];
1579 	uchar_t tmpiv[DEFAULT_AES_BLOCKLEN];
1580 
1581 	inlen = (size_t)MBLKL(mp);
1582 
1583 	enclen = inlen - AES_TRUNCATED_HMAC_LEN;
1584 	if (tmi->dec_data.ivec_usage != IVEC_NEVER &&
1585 		tmi->dec_data.ivec != NULL && tmi->dec_data.ivlen > 0) {
1586 		int nblocks = (enclen + DEFAULT_AES_BLOCKLEN - 1) /
1587 				DEFAULT_AES_BLOCKLEN;
1588 		bcopy(mp->b_rptr + DEFAULT_AES_BLOCKLEN * (nblocks - 2),
1589 			tmpiv, DEFAULT_AES_BLOCKLEN);
1590 	}
1591 
1592 	/* AES Decrypt */
1593 	result = aes_cbc_cts_decrypt(tmi, mp->b_rptr, enclen);
1594 
1595 	if (result != CRYPTO_SUCCESS) {
1596 		cmn_err(CE_WARN,
1597 			"aes_decrypt:  aes_cbc_cts_decrypt "
1598 			"failed - error %0x", result);
1599 		goto cleanup;
1600 	}
1601 
1602 	/* Verify the HMAC */
1603 	result = do_hmac(sha1_hmac_mech,
1604 			&tmi->dec_data.d_hmac_key,
1605 			(char *)mp->b_rptr, enclen,
1606 			(char *)hmacbuff, hash->hash_len);
1607 
1608 	if (result != CRYPTO_SUCCESS) {
1609 		cmn_err(CE_WARN,
1610 			"aes_decrypt:  do_hmac failed - error %0x", result);
1611 		goto cleanup;
1612 	}
1613 
1614 	if (bcmp(hmacbuff, mp->b_rptr + enclen,
1615 		AES_TRUNCATED_HMAC_LEN) != 0) {
1616 		result = -1;
1617 		cmn_err(CE_WARN, "aes_decrypt: checksum verification failed");
1618 		goto cleanup;
1619 	}
1620 
1621 	/* truncate the mblk at the end of the decrypted text */
1622 	mp->b_wptr = mp->b_rptr + enclen;
1623 
1624 	/* Adjust the beginning of the buffer to skip the confounder */
1625 	mp->b_rptr += DEFAULT_AES_BLOCKLEN;
1626 
1627 	if (tmi->dec_data.ivec_usage != IVEC_NEVER &&
1628 		tmi->dec_data.ivec != NULL && tmi->dec_data.ivlen > 0)
1629 		bcopy(tmpiv, tmi->dec_data.ivec, DEFAULT_AES_BLOCKLEN);
1630 
1631 cleanup:
1632 	if (result != CRYPTO_SUCCESS) {
1633 		mp->b_datap->db_type = M_ERROR;
1634 		mp->b_rptr = mp->b_datap->db_base;
1635 		*mp->b_rptr = EIO;
1636 		mp->b_wptr = mp->b_rptr + sizeof (char);
1637 		freemsg(mp->b_cont);
1638 		mp->b_cont = NULL;
1639 		qreply(WR(q), mp);
1640 		return (NULL);
1641 	}
1642 	return (mp);
1643 }
1644 
1645 /*
1646  * AES encrypt
1647  *
1648  * format of ciphertext when using AES
1649  *  +-------------+------------+------------+
1650  *  |  confounder | msg-data   |  hmac      |
1651  *  +-------------+------------+------------+
1652  */
1653 static mblk_t *
1654 aes_encrypt(queue_t *q, struct tmodinfo *tmi, mblk_t *mp,
1655 	hash_info_t *hash)
1656 {
1657 	int result;
1658 	size_t cipherlen;
1659 	size_t inlen;
1660 	uchar_t hmacbuff[64];
1661 
1662 	inlen = (size_t)MBLKL(mp);
1663 
1664 	cipherlen = encrypt_size(&tmi->enc_data, inlen);
1665 
1666 	ASSERT(MBLKSIZE(mp) >= cipherlen);
1667 
1668 	/*
1669 	 * Shift the rptr back enough to insert the confounder.
1670 	 */
1671 	mp->b_rptr -= DEFAULT_AES_BLOCKLEN;
1672 
1673 	/* Get random data for confounder */
1674 	(void) random_get_pseudo_bytes((uint8_t *)mp->b_rptr,
1675 		DEFAULT_AES_BLOCKLEN);
1676 
1677 	/*
1678 	 * Because we encrypt in-place, we need to calculate
1679 	 * the HMAC of the plaintext now, then stick it on
1680 	 * the end of the ciphertext down below.
1681 	 */
1682 	result = do_hmac(sha1_hmac_mech,
1683 			&tmi->enc_data.d_hmac_key,
1684 			(char *)mp->b_rptr, DEFAULT_AES_BLOCKLEN + inlen,
1685 			(char *)hmacbuff, hash->hash_len);
1686 
1687 	if (result != CRYPTO_SUCCESS) {
1688 		cmn_err(CE_WARN, "aes_encrypt:  do_hmac failed - error %0x",
1689 			result);
1690 		goto cleanup;
1691 	}
1692 	/* Encrypt using AES-CBC-CTS */
1693 	result = aes_cbc_cts_encrypt(tmi, mp->b_rptr,
1694 		inlen + DEFAULT_AES_BLOCKLEN);
1695 
1696 	if (result != CRYPTO_SUCCESS) {
1697 		cmn_err(CE_WARN, "aes_encrypt:  aes_cbc_cts_encrypt "
1698 			"failed - error %0x", result);
1699 		goto cleanup;
1700 	}
1701 
1702 	/* copy the truncated HMAC to the end of the mblk */
1703 	bcopy(hmacbuff, mp->b_rptr + DEFAULT_AES_BLOCKLEN + inlen,
1704 		AES_TRUNCATED_HMAC_LEN);
1705 
1706 	mp->b_wptr = mp->b_rptr + cipherlen;
1707 
1708 	/*
1709 	 * The final block of cipher text (not the HMAC) is used
1710 	 * as the next IV.
1711 	 */
1712 	if (tmi->enc_data.ivec_usage != IVEC_NEVER &&
1713 	    tmi->enc_data.ivec != NULL) {
1714 		int nblocks = (inlen + 2 * DEFAULT_AES_BLOCKLEN - 1) /
1715 			DEFAULT_AES_BLOCKLEN;
1716 
1717 		bcopy(mp->b_rptr + (nblocks - 2) * DEFAULT_AES_BLOCKLEN,
1718 			tmi->enc_data.ivec, DEFAULT_AES_BLOCKLEN);
1719 	}
1720 
1721 cleanup:
1722 	if (result != CRYPTO_SUCCESS) {
1723 		mp->b_datap->db_type = M_ERROR;
1724 		mp->b_rptr = mp->b_datap->db_base;
1725 		*mp->b_rptr = EIO;
1726 		mp->b_wptr = mp->b_rptr + sizeof (char);
1727 		freemsg(mp->b_cont);
1728 		mp->b_cont = NULL;
1729 		qreply(WR(q), mp);
1730 		return (NULL);
1731 	}
1732 	return (mp);
1733 }
1734 
1735 /*
1736  * ARCFOUR-HMAC-MD5 decrypt
1737  *
1738  * format of ciphertext when using ARCFOUR-HMAC-MD5
1739  *  +-----------+------------+------------+
1740  *  |  hmac     | confounder |  msg-data  |
1741  *  +-----------+------------+------------+
1742  *
1743  */
1744 static mblk_t *
1745 arcfour_hmac_md5_decrypt(queue_t *q, struct tmodinfo *tmi, mblk_t *mp,
1746 			hash_info_t *hash)
1747 {
1748 	int result;
1749 	size_t cipherlen;
1750 	size_t inlen;
1751 	size_t saltlen;
1752 	crypto_key_t k1, k2;
1753 	crypto_data_t indata;
1754 	iovec_t v1;
1755 	uchar_t ms_exp[9] = {0xab, 0xab, 0xab, 0xab, 0xab,
1756 				0xab, 0xab, 0xab, 0xab };
1757 	uchar_t k1data[CRYPT_ARCFOUR_KEYBYTES];
1758 	uchar_t k2data[CRYPT_ARCFOUR_KEYBYTES];
1759 	uchar_t cksum[MD5_HASHSIZE];
1760 	uchar_t saltdata[CRYPT_ARCFOUR_KEYBYTES];
1761 	crypto_mechanism_t mech;
1762 	int usage;
1763 
1764 	/* The usage constant is 1026 for all "old" rcmd mode operations */
1765 	if (tmi->dec_data.option_mask & CRYPTOPT_RCMD_MODE_V1)
1766 		usage = RCMDV1_USAGE;
1767 	else
1768 		usage = ARCFOUR_DECRYPT_USAGE;
1769 
1770 	/*
1771 	 * The size at this point should be the size of
1772 	 * all the plaintext plus the optional plaintext length
1773 	 * needed for RCMD V2 mode.  There should also be room
1774 	 * at the head of the mblk for the confounder and hash info.
1775 	 */
1776 	inlen = (size_t)MBLKL(mp);
1777 
1778 	/*
1779 	 * The cipherlen does not include the HMAC at the
1780 	 * head of the buffer.
1781 	 */
1782 	cipherlen = inlen - hash->hash_len;
1783 
1784 	ASSERT(MBLKSIZE(mp) >= cipherlen);
1785 	if (tmi->dec_data.method == CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP) {
1786 		bcopy(ARCFOUR_EXP_SALT, saltdata, strlen(ARCFOUR_EXP_SALT));
1787 		saltdata[9] = 0;
1788 		saltdata[10] = usage & 0xff;
1789 		saltdata[11] = (usage >> 8) & 0xff;
1790 		saltdata[12] = (usage >> 16) & 0xff;
1791 		saltdata[13] = (usage >> 24) & 0xff;
1792 		saltlen = 14;
1793 	} else {
1794 		saltdata[0] = usage & 0xff;
1795 		saltdata[1] = (usage >> 8) & 0xff;
1796 		saltdata[2] = (usage >> 16) & 0xff;
1797 		saltdata[3] = (usage >> 24) & 0xff;
1798 		saltlen = 4;
1799 	}
1800 	/*
1801 	 * Use the salt value to create a key to be used
1802 	 * for subsequent HMAC operations.
1803 	 */
1804 	result = do_hmac(md5_hmac_mech,
1805 			tmi->dec_data.ckey,
1806 			(char *)saltdata, saltlen,
1807 			(char *)k1data, sizeof (k1data));
1808 	if (result != CRYPTO_SUCCESS) {
1809 		cmn_err(CE_WARN,
1810 			"arcfour_hmac_md5_decrypt:  do_hmac(k1)"
1811 			"failed - error %0x", result);
1812 		goto cleanup;
1813 	}
1814 	bcopy(k1data, k2data, sizeof (k1data));
1815 
1816 	/*
1817 	 * For the neutered MS RC4 encryption type,
1818 	 * set the trailing 9 bytes to 0xab per the
1819 	 * RC4-HMAC spec.
1820 	 */
1821 	if (tmi->dec_data.method == CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP) {
1822 		bcopy((void *)&k1data[7], ms_exp, sizeof (ms_exp));
1823 	}
1824 
1825 	mech.cm_type = tmi->dec_data.mech_type;
1826 	mech.cm_param = NULL;
1827 	mech.cm_param_len = 0;
1828 
1829 	/*
1830 	 * If we have not yet initialized the decryption key,
1831 	 * context, and template, do it now.
1832 	 */
1833 	if (tmi->dec_data.ctx == NULL ||
1834 	    (tmi->dec_data.option_mask & CRYPTOPT_RCMD_MODE_V1)) {
1835 		k1.ck_format = CRYPTO_KEY_RAW;
1836 		k1.ck_length = CRYPT_ARCFOUR_KEYBYTES * 8;
1837 		k1.ck_data = k1data;
1838 
1839 		tmi->dec_data.d_encr_key.ck_format = CRYPTO_KEY_RAW;
1840 		tmi->dec_data.d_encr_key.ck_length = k1.ck_length;
1841 		if (tmi->dec_data.d_encr_key.ck_data == NULL)
1842 			tmi->dec_data.d_encr_key.ck_data = kmem_zalloc(
1843 				CRYPT_ARCFOUR_KEYBYTES, KM_SLEEP);
1844 
1845 		/*
1846 		 * HMAC operation creates the encryption
1847 		 * key to be used for the decrypt operations.
1848 		 */
1849 		result = do_hmac(md5_hmac_mech, &k1,
1850 			(char *)mp->b_rptr, hash->hash_len,
1851 			(char *)tmi->dec_data.d_encr_key.ck_data,
1852 			CRYPT_ARCFOUR_KEYBYTES);
1853 
1854 
1855 		if (result != CRYPTO_SUCCESS) {
1856 			cmn_err(CE_WARN,
1857 				"arcfour_hmac_md5_decrypt:  do_hmac(k3)"
1858 				"failed - error %0x", result);
1859 			goto cleanup;
1860 		}
1861 	}
1862 
1863 	tmi->dec_data.enc_tmpl = NULL;
1864 
1865 	if (tmi->dec_data.ctx == NULL &&
1866 	    (tmi->dec_data.option_mask & CRYPTOPT_RCMD_MODE_V2)) {
1867 		/*
1868 		 * Only create a template if we are doing
1869 		 * chaining from block to block.
1870 		 */
1871 		result = crypto_create_ctx_template(&mech,
1872 			&tmi->dec_data.d_encr_key,
1873 			&tmi->dec_data.enc_tmpl,
1874 			KM_SLEEP);
1875 		if (result == CRYPTO_NOT_SUPPORTED) {
1876 			tmi->dec_data.enc_tmpl = NULL;
1877 		} else if (result != CRYPTO_SUCCESS) {
1878 			cmn_err(CE_WARN,
1879 				"arcfour_hmac_md5_decrypt:  "
1880 				"failed to create dec template "
1881 				"for RC4 encrypt: %0x", result);
1882 			goto cleanup;
1883 		}
1884 
1885 		result = crypto_decrypt_init(&mech,
1886 			&tmi->dec_data.d_encr_key,
1887 			tmi->dec_data.enc_tmpl,
1888 			&tmi->dec_data.ctx, NULL);
1889 
1890 		if (result != CRYPTO_SUCCESS) {
1891 			cmn_err(CE_WARN, "crypto_decrypt_init failed:"
1892 				" %0x", result);
1893 			goto cleanup;
1894 		}
1895 	}
1896 
1897 	/* adjust the rptr so we don't decrypt the original hmac field */
1898 
1899 	v1.iov_base = (char *)mp->b_rptr + hash->hash_len;
1900 	v1.iov_len = cipherlen;
1901 
1902 	indata.cd_format = CRYPTO_DATA_RAW;
1903 	indata.cd_offset = 0;
1904 	indata.cd_length = cipherlen;
1905 	indata.cd_raw = v1;
1906 
1907 	if (tmi->dec_data.option_mask & CRYPTOPT_RCMD_MODE_V2)
1908 		result = crypto_decrypt_update(tmi->dec_data.ctx,
1909 			&indata, NULL, NULL);
1910 	else
1911 		result = crypto_decrypt(&mech, &indata,
1912 			&tmi->dec_data.d_encr_key, NULL, NULL, NULL);
1913 
1914 	if (result != CRYPTO_SUCCESS) {
1915 		cmn_err(CE_WARN, "crypto_decrypt_update failed:"
1916 			" %0x", result);
1917 		goto cleanup;
1918 	}
1919 
1920 	k2.ck_format = CRYPTO_KEY_RAW;
1921 	k2.ck_length = sizeof (k2data) * 8;
1922 	k2.ck_data = k2data;
1923 
1924 	result = do_hmac(md5_hmac_mech,
1925 			&k2,
1926 			(char *)mp->b_rptr + hash->hash_len, cipherlen,
1927 			(char *)cksum, hash->hash_len);
1928 
1929 	if (result != CRYPTO_SUCCESS) {
1930 		cmn_err(CE_WARN,
1931 			"arcfour_hmac_md5_decrypt:  do_hmac(k2)"
1932 			"failed - error %0x", result);
1933 		goto cleanup;
1934 	}
1935 
1936 	if (bcmp(cksum, mp->b_rptr, hash->hash_len) != 0) {
1937 		cmn_err(CE_WARN, "arcfour_decrypt HMAC comparison failed");
1938 		result = -1;
1939 		goto cleanup;
1940 	}
1941 
1942 	/*
1943 	 * adjust the start of the mblk to skip over the
1944 	 * hash and confounder.
1945 	 */
1946 	mp->b_rptr += hash->hash_len + hash->confound_len;
1947 
1948 cleanup:
1949 	bzero(k1data, sizeof (k1data));
1950 	bzero(k2data, sizeof (k2data));
1951 	bzero(cksum, sizeof (cksum));
1952 	bzero(saltdata, sizeof (saltdata));
1953 	if (result != CRYPTO_SUCCESS) {
1954 		mp->b_datap->db_type = M_ERROR;
1955 		mp->b_rptr = mp->b_datap->db_base;
1956 		*mp->b_rptr = EIO;
1957 		mp->b_wptr = mp->b_rptr + sizeof (char);
1958 		freemsg(mp->b_cont);
1959 		mp->b_cont = NULL;
1960 		qreply(WR(q), mp);
1961 		return (NULL);
1962 	}
1963 	return (mp);
1964 }
1965 
1966 /*
1967  * ARCFOUR-HMAC-MD5 encrypt
1968  *
1969  * format of ciphertext when using ARCFOUR-HMAC-MD5
1970  *  +-----------+------------+------------+
1971  *  |  hmac     | confounder |  msg-data  |
1972  *  +-----------+------------+------------+
1973  *
1974  */
1975 static mblk_t *
1976 arcfour_hmac_md5_encrypt(queue_t *q, struct tmodinfo *tmi, mblk_t *mp,
1977 			hash_info_t *hash)
1978 {
1979 	int result;
1980 	size_t cipherlen;
1981 	size_t inlen;
1982 	size_t saltlen;
1983 	crypto_key_t k1, k2;
1984 	crypto_data_t indata;
1985 	iovec_t v1;
1986 	uchar_t ms_exp[9] = {0xab, 0xab, 0xab, 0xab, 0xab,
1987 				0xab, 0xab, 0xab, 0xab };
1988 	uchar_t k1data[CRYPT_ARCFOUR_KEYBYTES];
1989 	uchar_t k2data[CRYPT_ARCFOUR_KEYBYTES];
1990 	uchar_t saltdata[CRYPT_ARCFOUR_KEYBYTES];
1991 	crypto_mechanism_t mech;
1992 	int usage;
1993 
1994 	bzero(&indata, sizeof (indata));
1995 
1996 	/* The usage constant is 1026 for all "old" rcmd mode operations */
1997 	if (tmi->enc_data.option_mask & CRYPTOPT_RCMD_MODE_V1)
1998 		usage = RCMDV1_USAGE;
1999 	else
2000 		usage = ARCFOUR_ENCRYPT_USAGE;
2001 
2002 	mech.cm_type = tmi->enc_data.mech_type;
2003 	mech.cm_param = NULL;
2004 	mech.cm_param_len = 0;
2005 
2006 	/*
2007 	 * The size at this point should be the size of
2008 	 * all the plaintext plus the optional plaintext length
2009 	 * needed for RCMD V2 mode.  There should also be room
2010 	 * at the head of the mblk for the confounder and hash info.
2011 	 */
2012 	inlen = (size_t)MBLKL(mp);
2013 
2014 	cipherlen = encrypt_size(&tmi->enc_data, inlen);
2015 
2016 	ASSERT(MBLKSIZE(mp) >= cipherlen);
2017 
2018 	/*
2019 	 * Shift the rptr back enough to insert
2020 	 * the confounder and hash.
2021 	 */
2022 	mp->b_rptr -= (hash->confound_len + hash->hash_len);
2023 
2024 	/* zero out the hash area */
2025 	bzero(mp->b_rptr, (size_t)hash->hash_len);
2026 
2027 	if (cipherlen > inlen) {
2028 		bzero(mp->b_wptr, MBLKTAIL(mp));
2029 	}
2030 
2031 	if (tmi->enc_data.method == CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP) {
2032 		bcopy(ARCFOUR_EXP_SALT, saltdata, strlen(ARCFOUR_EXP_SALT));
2033 		saltdata[9] = 0;
2034 		saltdata[10] = usage & 0xff;
2035 		saltdata[11] = (usage >> 8) & 0xff;
2036 		saltdata[12] = (usage >> 16) & 0xff;
2037 		saltdata[13] = (usage >> 24) & 0xff;
2038 		saltlen = 14;
2039 	} else {
2040 		saltdata[0] = usage & 0xff;
2041 		saltdata[1] = (usage >> 8) & 0xff;
2042 		saltdata[2] = (usage >> 16) & 0xff;
2043 		saltdata[3] = (usage >> 24) & 0xff;
2044 		saltlen = 4;
2045 	}
2046 	/*
2047 	 * Use the salt value to create a key to be used
2048 	 * for subsequent HMAC operations.
2049 	 */
2050 	result = do_hmac(md5_hmac_mech,
2051 			tmi->enc_data.ckey,
2052 			(char *)saltdata, saltlen,
2053 			(char *)k1data, sizeof (k1data));
2054 	if (result != CRYPTO_SUCCESS) {
2055 		cmn_err(CE_WARN,
2056 			"arcfour_hmac_md5_encrypt:  do_hmac(k1)"
2057 			"failed - error %0x", result);
2058 		goto cleanup;
2059 	}
2060 
2061 	bcopy(k1data, k2data, sizeof (k2data));
2062 
2063 	/*
2064 	 * For the neutered MS RC4 encryption type,
2065 	 * set the trailing 9 bytes to 0xab per the
2066 	 * RC4-HMAC spec.
2067 	 */
2068 	if (tmi->enc_data.method == CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP) {
2069 		bcopy((void *)&k1data[7], ms_exp, sizeof (ms_exp));
2070 	}
2071 
2072 	/*
2073 	 * Get the confounder bytes.
2074 	 */
2075 	(void) random_get_pseudo_bytes(
2076 			(uint8_t *)(mp->b_rptr + hash->hash_len),
2077 			(size_t)hash->confound_len);
2078 
2079 	k2.ck_data = k2data;
2080 	k2.ck_format = CRYPTO_KEY_RAW;
2081 	k2.ck_length = sizeof (k2data) * 8;
2082 
2083 	/*
2084 	 * This writes the HMAC to the hash area in the
2085 	 * mblk.  The key used is the one just created by
2086 	 * the previous HMAC operation.
2087 	 * The data being processed is the confounder bytes
2088 	 * PLUS the input plaintext.
2089 	 */
2090 	result = do_hmac(md5_hmac_mech, &k2,
2091 			(char *)mp->b_rptr + hash->hash_len,
2092 			hash->confound_len + inlen,
2093 			(char *)mp->b_rptr, hash->hash_len);
2094 	if (result != CRYPTO_SUCCESS) {
2095 		cmn_err(CE_WARN,
2096 			"arcfour_hmac_md5_encrypt:  do_hmac(k2)"
2097 			"failed - error %0x", result);
2098 		goto cleanup;
2099 	}
2100 	/*
2101 	 * Because of the odd way that MIT uses RC4 keys
2102 	 * on the rlogin stream, we only need to create
2103 	 * this key once.
2104 	 * However, if using "old" rcmd mode, we need to do
2105 	 * it every time.
2106 	 */
2107 	if (tmi->enc_data.ctx == NULL ||
2108 	    (tmi->enc_data.option_mask & CRYPTOPT_RCMD_MODE_V1)) {
2109 		crypto_key_t *key = &tmi->enc_data.d_encr_key;
2110 
2111 		k1.ck_data = k1data;
2112 		k1.ck_format = CRYPTO_KEY_RAW;
2113 		k1.ck_length = sizeof (k1data) * 8;
2114 
2115 		key->ck_format = CRYPTO_KEY_RAW;
2116 		key->ck_length = k1.ck_length;
2117 		if (key->ck_data == NULL)
2118 			key->ck_data = kmem_zalloc(
2119 				CRYPT_ARCFOUR_KEYBYTES, KM_SLEEP);
2120 
2121 		/*
2122 		 * The final HMAC operation creates the encryption
2123 		 * key to be used for the encrypt operation.
2124 		 */
2125 		result = do_hmac(md5_hmac_mech, &k1,
2126 			(char *)mp->b_rptr, hash->hash_len,
2127 			(char *)key->ck_data, CRYPT_ARCFOUR_KEYBYTES);
2128 
2129 		if (result != CRYPTO_SUCCESS) {
2130 			cmn_err(CE_WARN,
2131 				"arcfour_hmac_md5_encrypt:  do_hmac(k3)"
2132 				"failed - error %0x", result);
2133 			goto cleanup;
2134 		}
2135 	}
2136 
2137 	/*
2138 	 * If the context has not been initialized, do it now.
2139 	 */
2140 	if (tmi->enc_data.ctx == NULL &&
2141 	    (tmi->enc_data.option_mask & CRYPTOPT_RCMD_MODE_V2)) {
2142 		/*
2143 		 * Only create a template if we are doing
2144 		 * chaining from block to block.
2145 		 */
2146 		result = crypto_create_ctx_template(&mech,
2147 				&tmi->enc_data.d_encr_key,
2148 				&tmi->enc_data.enc_tmpl,
2149 				KM_SLEEP);
2150 		if (result == CRYPTO_NOT_SUPPORTED) {
2151 			tmi->enc_data.enc_tmpl = NULL;
2152 		} else if (result != CRYPTO_SUCCESS) {
2153 			cmn_err(CE_WARN, "failed to create enc template "
2154 				"for RC4 encrypt: %0x", result);
2155 			goto cleanup;
2156 		}
2157 
2158 		result = crypto_encrypt_init(&mech,
2159 					&tmi->enc_data.d_encr_key,
2160 					tmi->enc_data.enc_tmpl,
2161 					&tmi->enc_data.ctx, NULL);
2162 		if (result != CRYPTO_SUCCESS) {
2163 			cmn_err(CE_WARN, "crypto_encrypt_init failed:"
2164 				" %0x", result);
2165 			goto cleanup;
2166 		}
2167 	}
2168 	v1.iov_base = (char *)mp->b_rptr + hash->hash_len;
2169 	v1.iov_len = hash->confound_len + inlen;
2170 
2171 	indata.cd_format = CRYPTO_DATA_RAW;
2172 	indata.cd_offset = 0;
2173 	indata.cd_length = hash->confound_len + inlen;
2174 	indata.cd_raw = v1;
2175 
2176 	if (tmi->enc_data.option_mask & CRYPTOPT_RCMD_MODE_V2)
2177 		result = crypto_encrypt_update(tmi->enc_data.ctx,
2178 			&indata, NULL, NULL);
2179 	else
2180 		result = crypto_encrypt(&mech, &indata,
2181 			&tmi->enc_data.d_encr_key, NULL,
2182 			NULL, NULL);
2183 
2184 	if (result != CRYPTO_SUCCESS) {
2185 		cmn_err(CE_WARN, "crypto_encrypt_update failed: 0x%0x",
2186 			result);
2187 	}
2188 
2189 cleanup:
2190 	bzero(k1data, sizeof (k1data));
2191 	bzero(k2data, sizeof (k2data));
2192 	bzero(saltdata, sizeof (saltdata));
2193 	if (result != CRYPTO_SUCCESS) {
2194 		mp->b_datap->db_type = M_ERROR;
2195 		mp->b_rptr = mp->b_datap->db_base;
2196 		*mp->b_rptr = EIO;
2197 		mp->b_wptr = mp->b_rptr + sizeof (char);
2198 		freemsg(mp->b_cont);
2199 		mp->b_cont = NULL;
2200 		qreply(WR(q), mp);
2201 		return (NULL);
2202 	}
2203 	return (mp);
2204 }
2205 
2206 /*
2207  * DES-CBC-[HASH] encrypt
2208  *
2209  * Needed to support userland apps that must support Kerberos V5
2210  * encryption DES-CBC encryption modes.
2211  *
2212  * The HASH values supported are RAW(NULL), MD5, CRC32, and SHA1
2213  *
2214  * format of ciphertext for DES-CBC functions, per RFC1510 is:
2215  *  +-----------+----------+-------------+-----+
2216  *  |confounder |  cksum   |   msg-data  | pad |
2217  *  +-----------+----------+-------------+-----+
2218  *
2219  * format of ciphertext when using DES3-SHA1-HMAC
2220  *  +-----------+----------+-------------+-----+
2221  *  |confounder |  msg-data  |   hmac    | pad |
2222  *  +-----------+----------+-------------+-----+
2223  *
2224  *  The confounder is 8 bytes of random data.
2225  *  The cksum depends on the hash being used.
2226  *   4 bytes for CRC32
2227  *  16 bytes for MD5
2228  *  20 bytes for SHA1
2229  *   0 bytes for RAW
2230  *
2231  */
2232 static mblk_t *
2233 des_cbc_encrypt(queue_t *q, struct tmodinfo *tmi, mblk_t *mp, hash_info_t *hash)
2234 {
2235 	int result;
2236 	size_t cipherlen;
2237 	size_t inlen;
2238 	size_t plainlen;
2239 
2240 	/*
2241 	 * The size at this point should be the size of
2242 	 * all the plaintext plus the optional plaintext length
2243 	 * needed for RCMD V2 mode.  There should also be room
2244 	 * at the head of the mblk for the confounder and hash info.
2245 	 */
2246 	inlen = (size_t)MBLKL(mp);
2247 
2248 	/*
2249 	 * The output size will be a multiple of 8 because this algorithm
2250 	 * only works on 8 byte chunks.
2251 	 */
2252 	cipherlen = encrypt_size(&tmi->enc_data, inlen);
2253 
2254 	ASSERT(MBLKSIZE(mp) >= cipherlen);
2255 
2256 	if (cipherlen > inlen) {
2257 		bzero(mp->b_wptr, MBLKTAIL(mp));
2258 	}
2259 
2260 	/*
2261 	 * Shift the rptr back enough to insert
2262 	 * the confounder and hash.
2263 	 */
2264 	if (tmi->enc_data.method == CRYPT_METHOD_DES3_CBC_SHA1) {
2265 		mp->b_rptr -= hash->confound_len;
2266 	} else {
2267 		mp->b_rptr -= (hash->confound_len + hash->hash_len);
2268 
2269 		/* zero out the hash area */
2270 		bzero(mp->b_rptr + hash->confound_len, (size_t)hash->hash_len);
2271 	}
2272 
2273 	/* get random confounder from our friend, the 'random' module */
2274 	if (hash->confound_len > 0) {
2275 		(void) random_get_pseudo_bytes((uint8_t *)mp->b_rptr,
2276 				    (size_t)hash->confound_len);
2277 	}
2278 
2279 	/*
2280 	 * For 3DES we calculate an HMAC later.
2281 	 */
2282 	if (tmi->enc_data.method != CRYPT_METHOD_DES3_CBC_SHA1) {
2283 		/* calculate chksum of confounder + input */
2284 		if (hash->hash_len > 0 && hash->hashfunc != NULL) {
2285 			uchar_t cksum[MAX_CKSUM_LEN];
2286 
2287 			result = hash->hashfunc(cksum, mp->b_rptr,
2288 				cipherlen);
2289 			if (result != CRYPTO_SUCCESS) {
2290 				goto failure;
2291 			}
2292 
2293 			/* put hash in place right after the confounder */
2294 			bcopy(cksum, (mp->b_rptr + hash->confound_len),
2295 			    (size_t)hash->hash_len);
2296 		}
2297 	}
2298 	/*
2299 	 * In order to support the "old" Kerberos RCMD protocol,
2300 	 * we must use the IVEC 3 different ways:
2301 	 *   IVEC_REUSE = keep using the same IV each time, this is
2302 	 *		ugly and insecure, but necessary for
2303 	 *		backwards compatibility with existing MIT code.
2304 	 *   IVEC_ONETIME = Use the ivec as initialized when the crypto
2305 	 *		was setup (see setup_crypto routine).
2306 	 *   IVEC_NEVER = never use an IVEC, use a bunch of 0's as the IV (yuk).
2307 	 */
2308 	if (tmi->enc_data.ivec_usage == IVEC_NEVER) {
2309 		bzero(tmi->enc_data.block, tmi->enc_data.blocklen);
2310 	} else if (tmi->enc_data.ivec_usage == IVEC_REUSE) {
2311 		bcopy(tmi->enc_data.ivec, tmi->enc_data.block,
2312 		    tmi->enc_data.blocklen);
2313 	}
2314 
2315 	if (tmi->enc_data.method == CRYPT_METHOD_DES3_CBC_SHA1) {
2316 		/*
2317 		 * The input length already included the hash size,
2318 		 * don't include this in the plaintext length
2319 		 * calculations.
2320 		 */
2321 		plainlen = cipherlen - hash->hash_len;
2322 
2323 		mp->b_wptr = mp->b_rptr + plainlen;
2324 
2325 		result = kef_encr_hmac(&tmi->enc_data,
2326 			(void *)mp, (size_t)plainlen,
2327 			(char *)(mp->b_rptr + plainlen),
2328 			hash->hash_len);
2329 	} else {
2330 		ASSERT(mp->b_rptr + cipherlen <= DB_LIM(mp));
2331 		mp->b_wptr = mp->b_rptr + cipherlen;
2332 		result = kef_crypt(&tmi->enc_data, (void *)mp,
2333 			CRYPTO_DATA_MBLK, (size_t)cipherlen,
2334 			CRYPT_ENCRYPT);
2335 	}
2336 failure:
2337 	if (result != CRYPTO_SUCCESS) {
2338 #ifdef DEBUG
2339 		cmn_err(CE_WARN,
2340 			"des_cbc_encrypt: kef_crypt encrypt "
2341 			"failed (len: %ld) - error %0x",
2342 			cipherlen, result);
2343 #endif
2344 		mp->b_datap->db_type = M_ERROR;
2345 		mp->b_rptr = mp->b_datap->db_base;
2346 		*mp->b_rptr = EIO;
2347 		mp->b_wptr = mp->b_rptr + sizeof (char);
2348 		freemsg(mp->b_cont);
2349 		mp->b_cont = NULL;
2350 		qreply(WR(q), mp);
2351 		return (NULL);
2352 	} else if (tmi->enc_data.ivec_usage == IVEC_ONETIME) {
2353 		/*
2354 		 * Because we are using KEF, we must manually
2355 		 * update our IV.
2356 		 */
2357 		bcopy(mp->b_wptr - tmi->enc_data.ivlen,
2358 			tmi->enc_data.block, tmi->enc_data.ivlen);
2359 	}
2360 	if (tmi->enc_data.method == CRYPT_METHOD_DES3_CBC_SHA1) {
2361 		mp->b_wptr = mp->b_rptr + cipherlen;
2362 	}
2363 
2364 	return (mp);
2365 }
2366 
2367 /*
2368  * des_cbc_decrypt
2369  *
2370  *
2371  * Needed to support userland apps that must support Kerberos V5
2372  * encryption DES-CBC decryption modes.
2373  *
2374  * The HASH values supported are RAW(NULL), MD5, CRC32, and SHA1
2375  *
2376  * format of ciphertext for DES-CBC functions, per RFC1510 is:
2377  *  +-----------+----------+-------------+-----+
2378  *  |confounder |  cksum   |   msg-data  | pad |
2379  *  +-----------+----------+-------------+-----+
2380  *
2381  * format of ciphertext when using DES3-SHA1-HMAC
2382  *  +-----------+----------+-------------+-----+
2383  *  |confounder |  msg-data  |   hmac    | pad |
2384  *  +-----------+----------+-------------+-----+
2385  *
2386  *  The confounder is 8 bytes of random data.
2387  *  The cksum depends on the hash being used.
2388  *   4 bytes for CRC32
2389  *  16 bytes for MD5
2390  *  20 bytes for SHA1
2391  *   0 bytes for RAW
2392  *
2393  */
2394 static mblk_t *
2395 des_cbc_decrypt(queue_t *q, struct tmodinfo *tmi, mblk_t *mp, hash_info_t *hash)
2396 {
2397 	uint_t inlen, datalen;
2398 	int result = 0;
2399 	uchar_t *optr = NULL;
2400 	uchar_t cksum[MAX_CKSUM_LEN], newcksum[MAX_CKSUM_LEN];
2401 	uchar_t nextiv[DEFAULT_DES_BLOCKLEN];
2402 
2403 	/* Compute adjusted size */
2404 	inlen = MBLKL(mp);
2405 
2406 	optr = mp->b_rptr;
2407 
2408 	/*
2409 	 * In order to support the "old" Kerberos RCMD protocol,
2410 	 * we must use the IVEC 3 different ways:
2411 	 *   IVEC_REUSE = keep using the same IV each time, this is
2412 	 *		ugly and insecure, but necessary for
2413 	 *		backwards compatibility with existing MIT code.
2414 	 *   IVEC_ONETIME = Use the ivec as initialized when the crypto
2415 	 *		was setup (see setup_crypto routine).
2416 	 *   IVEC_NEVER = never use an IVEC, use a bunch of 0's as the IV (yuk).
2417 	 */
2418 	if (tmi->dec_data.ivec_usage == IVEC_NEVER)
2419 		bzero(tmi->dec_data.block, tmi->dec_data.blocklen);
2420 	else if (tmi->dec_data.ivec_usage == IVEC_REUSE)
2421 		bcopy(tmi->dec_data.ivec, tmi->dec_data.block,
2422 		    tmi->dec_data.blocklen);
2423 
2424 	if (tmi->dec_data.method == CRYPT_METHOD_DES3_CBC_SHA1) {
2425 		/*
2426 		 * Do not decrypt the HMAC at the end
2427 		 */
2428 		int decrypt_len = inlen - hash->hash_len;
2429 
2430 		/*
2431 		 * Move the wptr so the mblk appears to end
2432 		 * BEFORE the HMAC section.
2433 		 */
2434 		mp->b_wptr = mp->b_rptr + decrypt_len;
2435 
2436 		/*
2437 		 * Because we are using KEF, we must manually update our
2438 		 * IV.
2439 		 */
2440 		if (tmi->dec_data.ivec_usage == IVEC_ONETIME) {
2441 			bcopy(mp->b_rptr + decrypt_len - tmi->dec_data.ivlen,
2442 				nextiv, tmi->dec_data.ivlen);
2443 		}
2444 
2445 		result = kef_decr_hmac(&tmi->dec_data, mp, decrypt_len,
2446 			(char *)newcksum, hash->hash_len);
2447 	} else {
2448 		/*
2449 		 * Because we are using KEF, we must manually update our
2450 		 * IV.
2451 		 */
2452 		if (tmi->dec_data.ivec_usage == IVEC_ONETIME) {
2453 			bcopy(mp->b_wptr - tmi->enc_data.ivlen, nextiv,
2454 				tmi->dec_data.ivlen);
2455 		}
2456 		result = kef_crypt(&tmi->dec_data, (void *)mp,
2457 			CRYPTO_DATA_MBLK, (size_t)inlen, CRYPT_DECRYPT);
2458 	}
2459 	if (result != CRYPTO_SUCCESS) {
2460 #ifdef DEBUG
2461 		cmn_err(CE_WARN,
2462 			"des_cbc_decrypt: kef_crypt decrypt "
2463 			"failed - error %0x", result);
2464 #endif
2465 		mp->b_datap->db_type = M_ERROR;
2466 		mp->b_rptr = mp->b_datap->db_base;
2467 		*mp->b_rptr = EIO;
2468 		mp->b_wptr = mp->b_rptr + sizeof (char);
2469 		freemsg(mp->b_cont);
2470 		mp->b_cont = NULL;
2471 		qreply(WR(q), mp);
2472 		return (NULL);
2473 	}
2474 
2475 	/*
2476 	 * Manually update the IV, KEF does not track this for us.
2477 	 */
2478 	if (tmi->dec_data.ivec_usage == IVEC_ONETIME) {
2479 		bcopy(nextiv, tmi->dec_data.block, tmi->dec_data.ivlen);
2480 	}
2481 
2482 	/* Verify the checksum(if necessary) */
2483 	if (hash->hash_len > 0) {
2484 		if (tmi->dec_data.method == CRYPT_METHOD_DES3_CBC_SHA1) {
2485 			bcopy(mp->b_rptr + inlen - hash->hash_len, cksum,
2486 				hash->hash_len);
2487 		} else {
2488 			bcopy(optr + hash->confound_len, cksum, hash->hash_len);
2489 
2490 			/* zero the cksum in the buffer */
2491 			ASSERT(optr + hash->confound_len + hash->hash_len <=
2492 				DB_LIM(mp));
2493 			bzero(optr + hash->confound_len, hash->hash_len);
2494 
2495 			/* calculate MD5 chksum of confounder + input */
2496 			if (hash->hashfunc) {
2497 				(void) hash->hashfunc(newcksum, optr, inlen);
2498 			}
2499 		}
2500 
2501 		if (bcmp(cksum, newcksum, hash->hash_len)) {
2502 #ifdef DEBUG
2503 			cmn_err(CE_WARN, "des_cbc_decrypt: checksum "
2504 				"verification failed");
2505 #endif
2506 			mp->b_datap->db_type = M_ERROR;
2507 			mp->b_rptr = mp->b_datap->db_base;
2508 			*mp->b_rptr = EIO;
2509 			mp->b_wptr = mp->b_rptr + sizeof (char);
2510 			freemsg(mp->b_cont);
2511 			mp->b_cont = NULL;
2512 			qreply(WR(q), mp);
2513 			return (NULL);
2514 		}
2515 	}
2516 
2517 	datalen = inlen - hash->confound_len - hash->hash_len;
2518 
2519 	/* Move just the decrypted input into place if necessary */
2520 	if (hash->confound_len > 0 || hash->hash_len > 0) {
2521 		if (tmi->dec_data.method == CRYPT_METHOD_DES3_CBC_SHA1)
2522 			mp->b_rptr += hash->confound_len;
2523 		else
2524 			mp->b_rptr += hash->confound_len + hash->hash_len;
2525 	}
2526 
2527 	ASSERT(mp->b_rptr + datalen <= DB_LIM(mp));
2528 	mp->b_wptr = mp->b_rptr + datalen;
2529 
2530 	return (mp);
2531 }
2532 
2533 static mblk_t *
2534 do_decrypt(queue_t *q, mblk_t *mp)
2535 {
2536 	struct tmodinfo *tmi = (struct tmodinfo *)q->q_ptr;
2537 	mblk_t *outmp;
2538 
2539 	switch (tmi->dec_data.method) {
2540 	case CRYPT_METHOD_DES_CFB:
2541 		outmp = des_cfb_decrypt(q, tmi, mp);
2542 		break;
2543 	case CRYPT_METHOD_NONE:
2544 		outmp = mp;
2545 		break;
2546 	case CRYPT_METHOD_DES_CBC_NULL:
2547 		outmp = des_cbc_decrypt(q, tmi, mp, &null_hash);
2548 		break;
2549 	case CRYPT_METHOD_DES_CBC_MD5:
2550 		outmp = des_cbc_decrypt(q, tmi, mp, &md5_hash);
2551 		break;
2552 	case CRYPT_METHOD_DES_CBC_CRC:
2553 		outmp = des_cbc_decrypt(q, tmi, mp, &crc32_hash);
2554 		break;
2555 	case CRYPT_METHOD_DES3_CBC_SHA1:
2556 		outmp = des_cbc_decrypt(q, tmi, mp, &sha1_hash);
2557 		break;
2558 	case CRYPT_METHOD_ARCFOUR_HMAC_MD5:
2559 	case CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP:
2560 		outmp = arcfour_hmac_md5_decrypt(q, tmi, mp, &md5_hash);
2561 		break;
2562 	case CRYPT_METHOD_AES128:
2563 	case CRYPT_METHOD_AES256:
2564 		outmp = aes_decrypt(q, tmi, mp, &sha1_hash);
2565 		break;
2566 	}
2567 	return (outmp);
2568 }
2569 
2570 /*
2571  * do_encrypt
2572  *
2573  * Generic encryption routine for a single message block.
2574  * The input mblk may be replaced by some encrypt routines
2575  * because they add extra data in some cases that may exceed
2576  * the input mblk_t size limit.
2577  */
2578 static mblk_t *
2579 do_encrypt(queue_t *q, mblk_t *mp)
2580 {
2581 	struct tmodinfo *tmi = (struct tmodinfo *)q->q_ptr;
2582 	mblk_t *outmp;
2583 
2584 	switch (tmi->enc_data.method) {
2585 	case CRYPT_METHOD_DES_CFB:
2586 		outmp = des_cfb_encrypt(q, tmi, mp);
2587 		break;
2588 	case CRYPT_METHOD_DES_CBC_NULL:
2589 		outmp = des_cbc_encrypt(q, tmi, mp, &null_hash);
2590 		break;
2591 	case CRYPT_METHOD_DES_CBC_MD5:
2592 		outmp = des_cbc_encrypt(q, tmi, mp, &md5_hash);
2593 		break;
2594 	case CRYPT_METHOD_DES_CBC_CRC:
2595 		outmp = des_cbc_encrypt(q, tmi, mp, &crc32_hash);
2596 		break;
2597 	case CRYPT_METHOD_DES3_CBC_SHA1:
2598 		outmp = des_cbc_encrypt(q, tmi, mp, &sha1_hash);
2599 		break;
2600 	case CRYPT_METHOD_ARCFOUR_HMAC_MD5:
2601 	case CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP:
2602 		outmp = arcfour_hmac_md5_encrypt(q, tmi, mp, &md5_hash);
2603 		break;
2604 	case CRYPT_METHOD_AES128:
2605 	case CRYPT_METHOD_AES256:
2606 		outmp = aes_encrypt(q, tmi, mp, &sha1_hash);
2607 		break;
2608 	case CRYPT_METHOD_NONE:
2609 		outmp = mp;
2610 		break;
2611 	}
2612 	return (outmp);
2613 }
2614 
2615 /*
2616  * setup_crypto
2617  *
2618  * This takes the data from the CRYPTIOCSETUP ioctl
2619  * and sets up a cipher_data_t structure for either
2620  * encryption or decryption.  This is where the
2621  * key and initialization vector data get stored
2622  * prior to beginning any crypto functions.
2623  *
2624  * Special note:
2625  *   Some applications(e.g. telnetd) have ability to switch
2626  * crypto on/off periodically.  Thus, the application may call
2627  * the CRYPTIOCSETUP ioctl many times for the same stream.
2628  * If the CRYPTIOCSETUP is called with 0 length key or ivec fields
2629  * assume that the key, block, and saveblock fields that are already
2630  * set from a previous CRIOCSETUP call are still valid.  This helps avoid
2631  * a rekeying error that could occur if we overwrite these fields
2632  * with each CRYPTIOCSETUP call.
2633  *   In short, sometimes, CRYPTIOCSETUP is used to simply toggle on/off
2634  * without resetting the original crypto parameters.
2635  *
2636  */
2637 static int
2638 setup_crypto(struct cr_info_t *ci, struct cipher_data_t *cd, int encrypt)
2639 {
2640 	uint_t newblocklen;
2641 	uint32_t enc_usage = 0, dec_usage = 0;
2642 	int rv;
2643 
2644 	/*
2645 	 * Initial sanity checks
2646 	 */
2647 	if (!CR_METHOD_OK(ci->crypto_method)) {
2648 		cmn_err(CE_WARN, "Illegal crypto method (%d)",
2649 			ci->crypto_method);
2650 		return (EINVAL);
2651 	}
2652 	if (!CR_OPTIONS_OK(ci->option_mask)) {
2653 		cmn_err(CE_WARN, "Illegal crypto options (%d)",
2654 			ci->option_mask);
2655 		return (EINVAL);
2656 	}
2657 	if (!CR_IVUSAGE_OK(ci->ivec_usage)) {
2658 		cmn_err(CE_WARN, "Illegal ivec usage value (%d)",
2659 			ci->ivec_usage);
2660 		return (EINVAL);
2661 	}
2662 
2663 	cd->method = ci->crypto_method;
2664 	cd->bytes = 0;
2665 
2666 	if (ci->keylen > 0) {
2667 		if (cd->key != NULL) {
2668 			kmem_free(cd->key, cd->keylen);
2669 			cd->key = NULL;
2670 			cd->keylen = 0;
2671 		}
2672 		/*
2673 		 * cd->key holds the copy of the raw key bytes passed in
2674 		 * from the userland app.
2675 		 */
2676 		cd->key = (char *)kmem_alloc((size_t)ci->keylen, KM_SLEEP);
2677 
2678 		cd->keylen = ci->keylen;
2679 		bcopy(ci->key, cd->key, (size_t)ci->keylen);
2680 	}
2681 
2682 	/*
2683 	 * Configure the block size based on the type of cipher.
2684 	 */
2685 	switch (cd->method) {
2686 		case CRYPT_METHOD_NONE:
2687 			newblocklen = 0;
2688 			break;
2689 		case CRYPT_METHOD_DES_CFB:
2690 			newblocklen = DEFAULT_DES_BLOCKLEN;
2691 			cd->mech_type = crypto_mech2id(SUN_CKM_DES_ECB);
2692 			break;
2693 		case CRYPT_METHOD_DES_CBC_NULL:
2694 		case CRYPT_METHOD_DES_CBC_MD5:
2695 		case CRYPT_METHOD_DES_CBC_CRC:
2696 			newblocklen = DEFAULT_DES_BLOCKLEN;
2697 			cd->mech_type = crypto_mech2id(SUN_CKM_DES_CBC);
2698 			break;
2699 		case CRYPT_METHOD_DES3_CBC_SHA1:
2700 			newblocklen = DEFAULT_DES_BLOCKLEN;
2701 			cd->mech_type = crypto_mech2id(SUN_CKM_DES3_CBC);
2702 			/* 3DES always uses the old usage constant */
2703 			enc_usage = RCMDV1_USAGE;
2704 			dec_usage = RCMDV1_USAGE;
2705 			break;
2706 		case CRYPT_METHOD_ARCFOUR_HMAC_MD5:
2707 		case CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP:
2708 			newblocklen = 0;
2709 			cd->mech_type = crypto_mech2id(SUN_CKM_RC4);
2710 			break;
2711 		case CRYPT_METHOD_AES128:
2712 		case CRYPT_METHOD_AES256:
2713 			newblocklen = DEFAULT_AES_BLOCKLEN;
2714 			cd->mech_type = crypto_mech2id(SUN_CKM_AES_ECB);
2715 			enc_usage = AES_ENCRYPT_USAGE;
2716 			dec_usage = AES_DECRYPT_USAGE;
2717 			break;
2718 	}
2719 	if (cd->mech_type == CRYPTO_MECH_INVALID) {
2720 		return (CRYPTO_FAILED);
2721 	}
2722 
2723 	/*
2724 	 * If RC4, initialize the master crypto key used by
2725 	 * the RC4 algorithm to derive the final encrypt and decrypt keys.
2726 	 */
2727 	if (cd->keylen > 0 && IS_RC4_METHOD(cd->method)) {
2728 		/*
2729 		 * cd->ckey is a kernel crypto key structure used as the
2730 		 * master key in the RC4-HMAC crypto operations.
2731 		 */
2732 		if (cd->ckey == NULL) {
2733 			cd->ckey = (crypto_key_t *)kmem_zalloc(
2734 				sizeof (crypto_key_t), KM_SLEEP);
2735 		}
2736 
2737 		cd->ckey->ck_format = CRYPTO_KEY_RAW;
2738 		cd->ckey->ck_data = cd->key;
2739 
2740 		/* key length for EF is measured in bits */
2741 		cd->ckey->ck_length = cd->keylen * 8;
2742 	}
2743 
2744 	/*
2745 	 * cd->block and cd->saveblock are used as temporary storage for
2746 	 * data that must be carried over between encrypt/decrypt operations
2747 	 * in some of the "feedback" modes.
2748 	 */
2749 	if (newblocklen != cd->blocklen) {
2750 		if (cd->block != NULL) {
2751 			kmem_free(cd->block, cd->blocklen);
2752 			cd->block = NULL;
2753 		}
2754 
2755 		if (cd->saveblock != NULL) {
2756 			kmem_free(cd->saveblock, cd->blocklen);
2757 			cd->saveblock = NULL;
2758 		}
2759 
2760 		cd->blocklen = newblocklen;
2761 		if (cd->blocklen) {
2762 			cd->block = (char *)kmem_zalloc((size_t)cd->blocklen,
2763 				KM_SLEEP);
2764 		}
2765 
2766 		if (cd->method == CRYPT_METHOD_DES_CFB)
2767 			cd->saveblock = (char *)kmem_zalloc(cd->blocklen,
2768 						KM_SLEEP);
2769 		else
2770 			cd->saveblock = NULL;
2771 	}
2772 
2773 	if (ci->iveclen != cd->ivlen) {
2774 		if (cd->ivec != NULL) {
2775 			kmem_free(cd->ivec, cd->ivlen);
2776 			cd->ivec = NULL;
2777 		}
2778 		if (ci->ivec_usage != IVEC_NEVER && ci->iveclen > 0) {
2779 			cd->ivec = (char *)kmem_zalloc((size_t)ci->iveclen,
2780 						KM_SLEEP);
2781 			cd->ivlen = ci->iveclen;
2782 		} else {
2783 			cd->ivlen = 0;
2784 			cd->ivec = NULL;
2785 		}
2786 	}
2787 	cd->option_mask = ci->option_mask;
2788 
2789 	/*
2790 	 * Old protocol requires a static 'usage' value for
2791 	 * deriving keys.  Yuk.
2792 	 */
2793 	if (cd->option_mask & CRYPTOPT_RCMD_MODE_V1) {
2794 		enc_usage = dec_usage = RCMDV1_USAGE;
2795 	}
2796 
2797 	if (cd->ivlen > cd->blocklen) {
2798 		cmn_err(CE_WARN, "setup_crypto: IV longer than block size");
2799 		return (EINVAL);
2800 	}
2801 
2802 	/*
2803 	 * If we are using an IVEC "correctly" (i.e. set it once)
2804 	 * copy it here.
2805 	 */
2806 	if (ci->ivec_usage == IVEC_ONETIME && cd->block != NULL)
2807 		bcopy(ci->ivec, cd->block, (size_t)cd->ivlen);
2808 
2809 	cd->ivec_usage = ci->ivec_usage;
2810 	if (cd->ivec != NULL) {
2811 		/* Save the original IVEC in case we need it later */
2812 		bcopy(ci->ivec, cd->ivec, (size_t)cd->ivlen);
2813 	}
2814 	/*
2815 	 * Special handling for 3DES-SHA1-HMAC and AES crypto:
2816 	 * generate derived keys and context templates
2817 	 * for better performance.
2818 	 */
2819 	if (cd->method == CRYPT_METHOD_DES3_CBC_SHA1 ||
2820 	    IS_AES_METHOD(cd->method)) {
2821 		crypto_mechanism_t enc_mech;
2822 		crypto_mechanism_t hmac_mech;
2823 
2824 		if (cd->d_encr_key.ck_data != NULL) {
2825 			bzero(cd->d_encr_key.ck_data, cd->keylen);
2826 			kmem_free(cd->d_encr_key.ck_data, cd->keylen);
2827 		}
2828 
2829 		if (cd->d_hmac_key.ck_data != NULL) {
2830 			bzero(cd->d_hmac_key.ck_data, cd->keylen);
2831 			kmem_free(cd->d_hmac_key.ck_data, cd->keylen);
2832 		}
2833 
2834 		if (cd->enc_tmpl != NULL)
2835 			(void) crypto_destroy_ctx_template(cd->enc_tmpl);
2836 
2837 		if (cd->hmac_tmpl != NULL)
2838 			(void) crypto_destroy_ctx_template(cd->hmac_tmpl);
2839 
2840 		enc_mech.cm_type = cd->mech_type;
2841 		enc_mech.cm_param = cd->ivec;
2842 		enc_mech.cm_param_len = cd->ivlen;
2843 
2844 		hmac_mech.cm_type = sha1_hmac_mech;
2845 		hmac_mech.cm_param = NULL;
2846 		hmac_mech.cm_param_len = 0;
2847 
2848 		/*
2849 		 * Create the derived keys.
2850 		 */
2851 		rv = create_derived_keys(cd,
2852 			(encrypt ? enc_usage : dec_usage),
2853 			&cd->d_encr_key, &cd->d_hmac_key);
2854 
2855 		if (rv != CRYPTO_SUCCESS) {
2856 			cmn_err(CE_WARN, "failed to create derived "
2857 				"keys: %0x", rv);
2858 			return (CRYPTO_FAILED);
2859 		}
2860 
2861 		rv = crypto_create_ctx_template(&enc_mech,
2862 					&cd->d_encr_key,
2863 					&cd->enc_tmpl, KM_SLEEP);
2864 		if (rv == CRYPTO_MECH_NOT_SUPPORTED) {
2865 			cd->enc_tmpl = NULL;
2866 		} else if (rv != CRYPTO_SUCCESS) {
2867 			cmn_err(CE_WARN, "failed to create enc template "
2868 				"for d_encr_key: %0x", rv);
2869 			return (CRYPTO_FAILED);
2870 		}
2871 
2872 		rv = crypto_create_ctx_template(&hmac_mech,
2873 				&cd->d_hmac_key,
2874 				&cd->hmac_tmpl, KM_SLEEP);
2875 		if (rv == CRYPTO_MECH_NOT_SUPPORTED) {
2876 			cd->hmac_tmpl = NULL;
2877 		} else if (rv != CRYPTO_SUCCESS) {
2878 			cmn_err(CE_WARN, "failed to create hmac template:"
2879 				" %0x", rv);
2880 			return (CRYPTO_FAILED);
2881 		}
2882 	} else if (IS_RC4_METHOD(cd->method)) {
2883 		bzero(&cd->d_encr_key, sizeof (crypto_key_t));
2884 		bzero(&cd->d_hmac_key, sizeof (crypto_key_t));
2885 		cd->ctx = NULL;
2886 		cd->enc_tmpl = NULL;
2887 		cd->hmac_tmpl = NULL;
2888 	}
2889 
2890 	/* Final sanity checks, make sure no fields are NULL */
2891 	if (cd->method != CRYPT_METHOD_NONE) {
2892 		if (cd->block == NULL && cd->blocklen > 0) {
2893 #ifdef DEBUG
2894 			cmn_err(CE_WARN,
2895 				"setup_crypto: IV block not allocated");
2896 #endif
2897 			return (ENOMEM);
2898 		}
2899 		if (cd->key == NULL && cd->keylen > 0) {
2900 #ifdef DEBUG
2901 			cmn_err(CE_WARN,
2902 				"setup_crypto: key block not allocated");
2903 #endif
2904 			return (ENOMEM);
2905 		}
2906 		if (cd->method == CRYPT_METHOD_DES_CFB &&
2907 		    cd->saveblock == NULL && cd->blocklen > 0) {
2908 #ifdef DEBUG
2909 			cmn_err(CE_WARN,
2910 				"setup_crypto: save block not allocated");
2911 #endif
2912 			return (ENOMEM);
2913 		}
2914 		if (cd->ivec == NULL && cd->ivlen > 0) {
2915 #ifdef DEBUG
2916 			cmn_err(CE_WARN,
2917 				"setup_crypto: IV not allocated");
2918 #endif
2919 			return (ENOMEM);
2920 		}
2921 	}
2922 	return (0);
2923 }
2924 
2925 /*
2926  * RCMDS require a 4 byte, clear text
2927  * length field before each message.
2928  * Add it now.
2929  */
2930 static mblk_t *
2931 mklenmp(mblk_t *bp, uint32_t len)
2932 {
2933 	mblk_t *lenmp;
2934 	uchar_t *ucp;
2935 
2936 	if (bp->b_rptr - 4 < DB_BASE(bp) || DB_REF(bp) > 1) {
2937 		lenmp = allocb(4, BPRI_MED);
2938 		if (lenmp != NULL) {
2939 			lenmp->b_rptr = lenmp->b_wptr = DB_LIM(lenmp);
2940 			linkb(lenmp, bp);
2941 			bp = lenmp;
2942 		}
2943 	}
2944 	ucp = bp->b_rptr;
2945 	*--ucp = len;
2946 	*--ucp = len >> 8;
2947 	*--ucp = len >> 16;
2948 	*--ucp = len >> 24;
2949 
2950 	bp->b_rptr = ucp;
2951 
2952 	return (bp);
2953 }
2954 
2955 static mblk_t *
2956 encrypt_block(queue_t *q, struct tmodinfo *tmi, mblk_t *mp, size_t plainlen)
2957 {
2958 	mblk_t *newmp;
2959 	size_t headspace;
2960 
2961 	mblk_t *cbp;
2962 	size_t cipherlen;
2963 	size_t extra = 0;
2964 	uint32_t ptlen = (uint32_t)plainlen;
2965 	/*
2966 	 * If we are using the "NEW" RCMD mode,
2967 	 * add 4 bytes to the plaintext for the
2968 	 * plaintext length that gets prepended
2969 	 * before encrypting.
2970 	 */
2971 	if (tmi->enc_data.option_mask & CRYPTOPT_RCMD_MODE_V2)
2972 		ptlen += 4;
2973 
2974 	cipherlen = encrypt_size(&tmi->enc_data, (size_t)ptlen);
2975 
2976 	/*
2977 	 * if we must allocb, then make sure its enough
2978 	 * to hold the length field so we dont have to allocb
2979 	 * again down below in 'mklenmp'
2980 	 */
2981 	if (ANY_RCMD_MODE(tmi->enc_data.option_mask)) {
2982 		extra = sizeof (uint32_t);
2983 	}
2984 
2985 	/*
2986 	 * Calculate how much space is needed in front of
2987 	 * the data.
2988 	 */
2989 	headspace = plaintext_offset(&tmi->enc_data);
2990 
2991 	/*
2992 	 * If the current block is too small, reallocate
2993 	 * one large enough to hold the hdr, tail, and
2994 	 * ciphertext.
2995 	 */
2996 	if ((cipherlen + extra >= MBLKSIZE(mp)) || DB_REF(mp) > 1) {
2997 		int sz = P2ROUNDUP(cipherlen+extra, 8);
2998 
2999 		cbp = allocb_tmpl(sz, mp);
3000 		if (cbp == NULL) {
3001 			cmn_err(CE_WARN,
3002 				"allocb (%d bytes) failed", sz);
3003 				return (NULL);
3004 		}
3005 
3006 		cbp->b_cont = mp->b_cont;
3007 
3008 		/*
3009 		 * headspace includes the length fields needed
3010 		 * for the RCMD modes (v1 == 4 bytes, V2 = 8)
3011 		 */
3012 		ASSERT(cbp->b_rptr + P2ROUNDUP(plainlen+headspace, 8)
3013 			<= DB_LIM(cbp));
3014 
3015 		cbp->b_rptr = DB_BASE(cbp) + headspace;
3016 		bcopy(mp->b_rptr, cbp->b_rptr, plainlen);
3017 		cbp->b_wptr = cbp->b_rptr + plainlen;
3018 
3019 		freeb(mp);
3020 	} else {
3021 		size_t extra = 0;
3022 		cbp = mp;
3023 
3024 		/*
3025 		 * Some ciphers add HMAC after the final block
3026 		 * of the ciphertext, not at the beginning like the
3027 		 * 1-DES ciphers.
3028 		 */
3029 		if (tmi->enc_data.method ==
3030 			CRYPT_METHOD_DES3_CBC_SHA1 ||
3031 		    IS_AES_METHOD(tmi->enc_data.method)) {
3032 			extra = sha1_hash.hash_len;
3033 		}
3034 
3035 		/*
3036 		 * Make sure the rptr is positioned correctly so that
3037 		 * routines later do not have to shift this data around
3038 		 */
3039 		if ((cbp->b_rptr + P2ROUNDUP(cipherlen + extra, 8) >
3040 			DB_LIM(cbp)) ||
3041 			(cbp->b_rptr - headspace < DB_BASE(cbp))) {
3042 			ovbcopy(cbp->b_rptr, DB_BASE(cbp) + headspace,
3043 				plainlen);
3044 			cbp->b_rptr = DB_BASE(cbp) + headspace;
3045 			cbp->b_wptr = cbp->b_rptr + plainlen;
3046 		}
3047 	}
3048 
3049 	ASSERT(cbp->b_rptr - headspace >= DB_BASE(cbp));
3050 	ASSERT(cbp->b_wptr <= DB_LIM(cbp));
3051 
3052 	/*
3053 	 * If using RCMD_MODE_V2 (new rcmd mode), prepend
3054 	 * the plaintext length before the actual plaintext.
3055 	 */
3056 	if (tmi->enc_data.option_mask & CRYPTOPT_RCMD_MODE_V2) {
3057 		cbp->b_rptr -= RCMD_LEN_SZ;
3058 
3059 		/* put plaintext length at head of buffer */
3060 		*(cbp->b_rptr + 3) = (uchar_t)(plainlen & 0xff);
3061 		*(cbp->b_rptr + 2) = (uchar_t)((plainlen >> 8) & 0xff);
3062 		*(cbp->b_rptr + 1) = (uchar_t)((plainlen >> 16) & 0xff);
3063 		*(cbp->b_rptr) = (uchar_t)((plainlen >> 24) & 0xff);
3064 	}
3065 
3066 	newmp = do_encrypt(q, cbp);
3067 
3068 	if (newmp != NULL &&
3069 	    (tmi->enc_data.option_mask &
3070 	    (CRYPTOPT_RCMD_MODE_V1 | CRYPTOPT_RCMD_MODE_V2))) {
3071 		mblk_t *lp;
3072 		/*
3073 		 * Add length field, required when this is
3074 		 * used to encrypt "r*" commands(rlogin, rsh)
3075 		 * with Kerberos.
3076 		 */
3077 		lp = mklenmp(newmp, plainlen);
3078 
3079 		if (lp == NULL) {
3080 			freeb(newmp);
3081 			return (NULL);
3082 		} else {
3083 			newmp = lp;
3084 		}
3085 	}
3086 	return (newmp);
3087 }
3088 
3089 /*
3090  * encrypt_msgb
3091  *
3092  * encrypt a single message. This routine adds the
3093  * RCMD overhead bytes when necessary.
3094  */
3095 static mblk_t *
3096 encrypt_msgb(queue_t *q, struct tmodinfo *tmi, mblk_t *mp)
3097 {
3098 	size_t plainlen, outlen;
3099 	mblk_t *newmp = NULL;
3100 
3101 	/* If not encrypting, do nothing */
3102 	if (tmi->enc_data.method == CRYPT_METHOD_NONE) {
3103 		return (mp);
3104 	}
3105 
3106 	plainlen = MBLKL(mp);
3107 	if (plainlen == 0)
3108 		return (NULL);
3109 
3110 	/*
3111 	 * If the block is too big, we encrypt in 4K chunks so that
3112 	 * older rlogin clients do not choke on the larger buffers.
3113 	 */
3114 	while ((plainlen = MBLKL(mp)) > MSGBUF_SIZE) {
3115 		mblk_t *mp1 = NULL;
3116 		outlen = MSGBUF_SIZE;
3117 		/*
3118 		 * Allocate a new buffer that is only 4K bytes, the
3119 		 * extra bytes are for crypto overhead.
3120 		 */
3121 		mp1 = allocb(outlen + CONFOUNDER_BYTES, BPRI_MED);
3122 		if (mp1 == NULL) {
3123 			cmn_err(CE_WARN,
3124 				"allocb (%d bytes) failed",
3125 				(int)(outlen + CONFOUNDER_BYTES));
3126 			return (NULL);
3127 		}
3128 		/* Copy the next 4K bytes from the old block. */
3129 		bcopy(mp->b_rptr, mp1->b_rptr, outlen);
3130 		mp1->b_wptr = mp1->b_rptr + outlen;
3131 		/* Advance the old block. */
3132 		mp->b_rptr += outlen;
3133 
3134 		/* encrypt the new block */
3135 		newmp = encrypt_block(q, tmi, mp1, outlen);
3136 		if (newmp == NULL)
3137 			return (NULL);
3138 
3139 		putnext(q, newmp);
3140 	}
3141 	newmp = NULL;
3142 	/* If there is data left (< MSGBUF_SIZE), encrypt it. */
3143 	if ((plainlen = MBLKL(mp)) > 0)
3144 		newmp = encrypt_block(q, tmi, mp, plainlen);
3145 
3146 	return (newmp);
3147 }
3148 
3149 /*
3150  * cryptmodwsrv
3151  *
3152  * Service routine for the write queue.
3153  *
3154  * Because data may be placed in the queue to hold between
3155  * the CRYPTIOCSTOP and CRYPTIOCSTART ioctls, the service routine is needed.
3156  */
3157 static int
3158 cryptmodwsrv(queue_t *q)
3159 {
3160 	mblk_t *mp;
3161 	struct tmodinfo *tmi = (struct tmodinfo *)q->q_ptr;
3162 
3163 	while ((mp = getq(q)) != NULL) {
3164 		switch (mp->b_datap->db_type) {
3165 		default:
3166 			/*
3167 			 * wput does not queue anything > QPCTL
3168 			 */
3169 			if (!canputnext(q) ||
3170 			    !(tmi->ready & CRYPT_WRITE_READY)) {
3171 				if (!putbq(q, mp)) {
3172 					freemsg(mp);
3173 				}
3174 				return (0);
3175 			}
3176 			putnext(q, mp);
3177 			break;
3178 		case M_DATA:
3179 			if (canputnext(q) && (tmi->ready & CRYPT_WRITE_READY)) {
3180 				mblk_t *bp;
3181 				mblk_t *newmsg = NULL;
3182 
3183 				/*
3184 				 * If multiple msgs, concat into 1
3185 				 * to minimize crypto operations later.
3186 				 */
3187 				if (mp->b_cont != NULL) {
3188 					bp = msgpullup(mp, -1);
3189 					if (bp != NULL) {
3190 						freemsg(mp);
3191 						mp = bp;
3192 					}
3193 				}
3194 				newmsg = encrypt_msgb(q, tmi, mp);
3195 				if (newmsg != NULL)
3196 					putnext(q, newmsg);
3197 			} else {
3198 				if (!putbq(q, mp)) {
3199 					freemsg(mp);
3200 				}
3201 				return (0);
3202 			}
3203 			break;
3204 		}
3205 	}
3206 	return (0);
3207 }
3208 
3209 static void
3210 start_stream(queue_t *wq, mblk_t *mp, uchar_t dir)
3211 {
3212 	mblk_t *newmp = NULL;
3213 	struct tmodinfo *tmi = (struct tmodinfo *)wq->q_ptr;
3214 
3215 	if (dir == CRYPT_ENCRYPT) {
3216 		tmi->ready |= CRYPT_WRITE_READY;
3217 		(void) (STRLOG(CRYPTMOD_ID, 0, 5, SL_TRACE|SL_NOTE,
3218 				"start_stream: restart ENCRYPT/WRITE q"));
3219 
3220 		enableok(wq);
3221 		qenable(wq);
3222 	} else if (dir == CRYPT_DECRYPT) {
3223 		/*
3224 		 * put any extra data in the RD
3225 		 * queue to be processed and
3226 		 * sent back up.
3227 		 */
3228 		newmp = mp->b_cont;
3229 		mp->b_cont = NULL;
3230 
3231 		tmi->ready |= CRYPT_READ_READY;
3232 		(void) (STRLOG(CRYPTMOD_ID, 0, 5,
3233 				SL_TRACE|SL_NOTE,
3234 				"start_stream: restart "
3235 				"DECRYPT/READ q"));
3236 
3237 		if (newmp != NULL)
3238 			if (!putbq(RD(wq), newmp))
3239 				freemsg(newmp);
3240 
3241 		enableok(RD(wq));
3242 		qenable(RD(wq));
3243 	}
3244 
3245 	miocack(wq, mp, 0, 0);
3246 }
3247 
3248 /*
3249  * Write-side put procedure.  Its main task is to detect ioctls and
3250  * FLUSH operations.  Other message types are passed on through.
3251  */
3252 static void
3253 cryptmodwput(queue_t *wq, mblk_t *mp)
3254 {
3255 	struct iocblk *iocp;
3256 	struct tmodinfo *tmi = (struct tmodinfo *)wq->q_ptr;
3257 	int ret, err;
3258 
3259 	switch (mp->b_datap->db_type) {
3260 	case M_DATA:
3261 		if (wq->q_first == NULL && canputnext(wq) &&
3262 		    (tmi->ready & CRYPT_WRITE_READY) &&
3263 		    tmi->enc_data.method == CRYPT_METHOD_NONE) {
3264 			putnext(wq, mp);
3265 			return;
3266 		}
3267 		/* else, put it in the service queue */
3268 		if (!putq(wq, mp)) {
3269 			freemsg(mp);
3270 		}
3271 		break;
3272 	case M_FLUSH:
3273 		if (*mp->b_rptr & FLUSHW) {
3274 			flushq(wq, FLUSHDATA);
3275 		}
3276 		putnext(wq, mp);
3277 		break;
3278 	case M_IOCTL:
3279 		iocp = (struct iocblk *)mp->b_rptr;
3280 		switch (iocp->ioc_cmd) {
3281 		case CRYPTIOCSETUP:
3282 			ret = 0;
3283 			(void) (STRLOG(CRYPTMOD_ID, 0, 5,
3284 					SL_TRACE | SL_NOTE,
3285 					"wput: got CRYPTIOCSETUP "
3286 					"ioctl(%d)", iocp->ioc_cmd));
3287 
3288 			if ((err = miocpullup(mp,
3289 					sizeof (struct cr_info_t))) != 0) {
3290 				cmn_err(CE_WARN,
3291 				"wput: miocpullup failed for cr_info_t");
3292 				miocnak(wq, mp, 0, err);
3293 			} else {
3294 				struct cr_info_t *ci;
3295 				ci = (struct cr_info_t *)mp->b_cont->b_rptr;
3296 
3297 				if (ci->direction_mask & CRYPT_ENCRYPT) {
3298 				    ret = setup_crypto(ci, &tmi->enc_data, 1);
3299 				}
3300 
3301 				if (ret == 0 &&
3302 				    (ci->direction_mask & CRYPT_DECRYPT)) {
3303 				    ret = setup_crypto(ci, &tmi->dec_data, 0);
3304 				}
3305 				if (ret == 0 &&
3306 				    (ci->direction_mask & CRYPT_DECRYPT) &&
3307 				    ANY_RCMD_MODE(tmi->dec_data.option_mask)) {
3308 					bzero(&tmi->rcmd_state,
3309 					    sizeof (tmi->rcmd_state));
3310 				}
3311 				if (ret == 0) {
3312 					miocack(wq, mp, 0, 0);
3313 				} else {
3314 					cmn_err(CE_WARN,
3315 						"wput: setup_crypto failed");
3316 					miocnak(wq, mp, 0, ret);
3317 				}
3318 				(void) (STRLOG(CRYPTMOD_ID, 0, 5,
3319 						SL_TRACE|SL_NOTE,
3320 						"wput: done with SETUP "
3321 						"ioctl"));
3322 			}
3323 			break;
3324 		case CRYPTIOCSTOP:
3325 			(void) (STRLOG(CRYPTMOD_ID, 0, 5,
3326 					SL_TRACE|SL_NOTE,
3327 					"wput: got CRYPTIOCSTOP "
3328 					"ioctl(%d)", iocp->ioc_cmd));
3329 
3330 			if ((err = miocpullup(mp, sizeof (uint32_t))) != 0) {
3331 				cmn_err(CE_WARN,
3332 					"wput: CRYPTIOCSTOP ioctl wrong "
3333 					"size (%d should be %d)",
3334 					(int)iocp->ioc_count,
3335 					(int)sizeof (uint32_t));
3336 				miocnak(wq, mp, 0, err);
3337 			} else {
3338 				uint32_t *stopdir;
3339 
3340 				stopdir = (uint32_t *)mp->b_cont->b_rptr;
3341 				if (!CR_DIRECTION_OK(*stopdir)) {
3342 					miocnak(wq, mp, 0, EINVAL);
3343 					return;
3344 				}
3345 
3346 				/* disable the queues until further notice */
3347 				if (*stopdir & CRYPT_ENCRYPT) {
3348 					noenable(wq);
3349 					tmi->ready &= ~CRYPT_WRITE_READY;
3350 				}
3351 				if (*stopdir & CRYPT_DECRYPT) {
3352 					noenable(RD(wq));
3353 					tmi->ready &= ~CRYPT_READ_READY;
3354 				}
3355 
3356 				miocack(wq, mp, 0, 0);
3357 			}
3358 			break;
3359 		case CRYPTIOCSTARTDEC:
3360 			(void) (STRLOG(CRYPTMOD_ID, 0, 5,
3361 					SL_TRACE|SL_NOTE,
3362 					"wput: got CRYPTIOCSTARTDEC "
3363 					"ioctl(%d)", iocp->ioc_cmd));
3364 
3365 			start_stream(wq, mp, CRYPT_DECRYPT);
3366 			break;
3367 		case CRYPTIOCSTARTENC:
3368 			(void) (STRLOG(CRYPTMOD_ID, 0, 5,
3369 					SL_TRACE|SL_NOTE,
3370 					"wput: got CRYPTIOCSTARTENC "
3371 					"ioctl(%d)", iocp->ioc_cmd));
3372 
3373 			start_stream(wq, mp, CRYPT_ENCRYPT);
3374 			break;
3375 		default:
3376 			putnext(wq, mp);
3377 			break;
3378 		}
3379 		break;
3380 	default:
3381 		if (queclass(mp) < QPCTL) {
3382 			if (wq->q_first != NULL || !canputnext(wq)) {
3383 				if (!putq(wq, mp))
3384 					freemsg(mp);
3385 				return;
3386 			}
3387 		}
3388 		putnext(wq, mp);
3389 		break;
3390 	}
3391 }
3392 
3393 /*
3394  * decrypt_rcmd_mblks
3395  *
3396  * Because kerberized r* commands(rsh, rlogin, etc)
3397  * use a 4 byte length field to indicate the # of
3398  * PLAINTEXT bytes that are encrypted in the field
3399  * that follows, we must parse out each message and
3400  * break out the length fields prior to sending them
3401  * upstream to our Solaris r* clients/servers which do
3402  * NOT understand this format.
3403  *
3404  * Kerberized/encrypted message format:
3405  * -------------------------------
3406  * | XXXX | N bytes of ciphertext|
3407  * -------------------------------
3408  *
3409  * Where: XXXX = number of plaintext bytes that were encrypted in
3410  *               to make the ciphertext field.  This is done
3411  *               because we are using a cipher that pads out to
3412  *               an 8 byte boundary.  We only want the application
3413  *               layer to see the correct number of plain text bytes,
3414  *               not plaintext + pad.  So, after we decrypt, we
3415  *               must trim the output block down to the intended
3416  *               plaintext length and eliminate the pad bytes.
3417  *
3418  * This routine takes the entire input message, breaks it into
3419  * a new message that does not contain these length fields and
3420  * returns a message consisting of mblks filled with just ciphertext.
3421  *
3422  */
3423 static mblk_t *
3424 decrypt_rcmd_mblks(queue_t *q, mblk_t *mp)
3425 {
3426 	mblk_t *newmp = NULL;
3427 	size_t msglen;
3428 	struct tmodinfo *tmi = (struct tmodinfo *)q->q_ptr;
3429 
3430 	msglen = msgsize(mp);
3431 
3432 	/*
3433 	 * If we need the length field, get it here.
3434 	 * Test the "plaintext length" indicator.
3435 	 */
3436 	if (tmi->rcmd_state.pt_len == 0) {
3437 		uint32_t elen;
3438 		int tocopy;
3439 		mblk_t *nextp;
3440 
3441 		/*
3442 		 * Make sure we have recieved all 4 bytes of the
3443 		 * length field.
3444 		 */
3445 		while (mp != NULL) {
3446 			ASSERT(tmi->rcmd_state.cd_len < sizeof (uint32_t));
3447 
3448 			tocopy = sizeof (uint32_t) -
3449 				tmi->rcmd_state.cd_len;
3450 			if (tocopy > msglen)
3451 				tocopy = msglen;
3452 
3453 			ASSERT(mp->b_rptr + tocopy <= DB_LIM(mp));
3454 			bcopy(mp->b_rptr,
3455 				(char *)(&tmi->rcmd_state.next_len +
3456 					tmi->rcmd_state.cd_len), tocopy);
3457 
3458 			tmi->rcmd_state.cd_len += tocopy;
3459 
3460 			if (tmi->rcmd_state.cd_len >= sizeof (uint32_t)) {
3461 				tmi->rcmd_state.next_len =
3462 					ntohl(tmi->rcmd_state.next_len);
3463 				break;
3464 			}
3465 
3466 			nextp = mp->b_cont;
3467 			mp->b_cont = NULL;
3468 			freeb(mp);
3469 			mp = nextp;
3470 		}
3471 
3472 		if (mp == NULL) {
3473 			return (NULL);
3474 		}
3475 		/*
3476 		 * recalculate the msglen now that we've read the
3477 		 * length and adjusted the bufptr (b_rptr).
3478 		 */
3479 		msglen -= tocopy;
3480 		mp->b_rptr += tocopy;
3481 
3482 		tmi->rcmd_state.pt_len = tmi->rcmd_state.next_len;
3483 
3484 		if (tmi->rcmd_state.pt_len <= 0) {
3485 			/*
3486 			 * Return an IO error to break the connection. there
3487 			 * is no way to recover from this.  Usually it means
3488 			 * the app has incorrectly requested decryption on
3489 			 * a non-encrypted stream, thus the "pt_len" field
3490 			 * is negative.
3491 			 */
3492 			mp->b_datap->db_type = M_ERROR;
3493 			mp->b_rptr = mp->b_datap->db_base;
3494 			*mp->b_rptr = EIO;
3495 			mp->b_wptr = mp->b_rptr + sizeof (char);
3496 
3497 			freemsg(mp->b_cont);
3498 			mp->b_cont = NULL;
3499 			qreply(WR(q), mp);
3500 			tmi->rcmd_state.cd_len = tmi->rcmd_state.pt_len = 0;
3501 			return (NULL);
3502 		}
3503 
3504 		/*
3505 		 * If this is V2 mode, then the encrypted data is actually
3506 		 * 4 bytes bigger than the indicated len because the plaintext
3507 		 * length is encrypted for an additional security check, but
3508 		 * its not counted as part of the overall length we just read.
3509 		 * Strange and confusing, but true.
3510 		 */
3511 
3512 		if (tmi->dec_data.option_mask & CRYPTOPT_RCMD_MODE_V2)
3513 			elen = tmi->rcmd_state.pt_len + 4;
3514 		else
3515 			elen = tmi->rcmd_state.pt_len;
3516 
3517 		tmi->rcmd_state.cd_len  = encrypt_size(&tmi->dec_data, elen);
3518 
3519 		/*
3520 		 * Allocate an mblk to hold the cipher text until it is
3521 		 * all ready to be processed.
3522 		 */
3523 		tmi->rcmd_state.c_msg = allocb(tmi->rcmd_state.cd_len,
3524 						BPRI_HI);
3525 		if (tmi->rcmd_state.c_msg == NULL) {
3526 #ifdef DEBUG
3527 			cmn_err(CE_WARN, "decrypt_rcmd_msgb: allocb failed "
3528 				"for %d bytes",
3529 				(int)tmi->rcmd_state.cd_len);
3530 #endif
3531 			/*
3532 			 * Return an IO error to break the connection.
3533 			 */
3534 			mp->b_datap->db_type = M_ERROR;
3535 			mp->b_rptr = mp->b_datap->db_base;
3536 			*mp->b_rptr = EIO;
3537 			mp->b_wptr = mp->b_rptr + sizeof (char);
3538 			freemsg(mp->b_cont);
3539 			mp->b_cont = NULL;
3540 			tmi->rcmd_state.cd_len = tmi->rcmd_state.pt_len = 0;
3541 			qreply(WR(q), mp);
3542 			return (NULL);
3543 		}
3544 	}
3545 
3546 	/*
3547 	 * If this entire message was just the length field,
3548 	 * free and return.  The actual data will probably be next.
3549 	 */
3550 	if (msglen == 0) {
3551 		freemsg(mp);
3552 		return (NULL);
3553 	}
3554 
3555 	/*
3556 	 * Copy as much of the cipher text as possible into
3557 	 * the new msgb (c_msg).
3558 	 *
3559 	 * Logic:  if we got some bytes (msglen) and we still
3560 	 * 	"need" some bytes (len-rcvd), get them here.
3561 	 */
3562 	ASSERT(tmi->rcmd_state.c_msg != NULL);
3563 	if (msglen > 0 &&
3564 	    (tmi->rcmd_state.cd_len > MBLKL(tmi->rcmd_state.c_msg))) {
3565 		mblk_t *bp, *nextp;
3566 		size_t n;
3567 
3568 		/*
3569 		 * Walk the mblks and copy just as many bytes as we need
3570 		 * for this particular block of cipher text.
3571 		 */
3572 		bp = mp;
3573 		while (bp != NULL) {
3574 			size_t needed;
3575 			size_t tocopy;
3576 			n = MBLKL(bp);
3577 
3578 			needed = tmi->rcmd_state.cd_len -
3579 				MBLKL(tmi->rcmd_state.c_msg);
3580 
3581 			tocopy = (needed >= n ? n : needed);
3582 
3583 			ASSERT(bp->b_rptr + tocopy <= DB_LIM(bp));
3584 			ASSERT(tmi->rcmd_state.c_msg->b_wptr + tocopy <=
3585 				DB_LIM(tmi->rcmd_state.c_msg));
3586 
3587 			/* Copy to end of new mblk */
3588 			bcopy(bp->b_rptr, tmi->rcmd_state.c_msg->b_wptr,
3589 				tocopy);
3590 
3591 			tmi->rcmd_state.c_msg->b_wptr += tocopy;
3592 
3593 			bp->b_rptr += tocopy;
3594 
3595 			nextp = bp->b_cont;
3596 
3597 			/*
3598 			 * If we used this whole block, free it and
3599 			 * move on.
3600 			 */
3601 			if (!MBLKL(bp)) {
3602 				freeb(bp);
3603 				bp = NULL;
3604 			}
3605 
3606 			/* If we got what we needed, stop the loop */
3607 			if (MBLKL(tmi->rcmd_state.c_msg) ==
3608 			    tmi->rcmd_state.cd_len) {
3609 				/*
3610 				 * If there is more data in the message,
3611 				 * its for another block of cipher text,
3612 				 * put it back in the queue for next time.
3613 				 */
3614 				if (bp) {
3615 					if (!putbq(q, bp))
3616 						freemsg(bp);
3617 				} else if (nextp != NULL) {
3618 					/*
3619 					 * If there is more, put it back in the
3620 					 * queue for another pass thru.
3621 					 */
3622 					if (!putbq(q, nextp))
3623 						freemsg(nextp);
3624 				}
3625 				break;
3626 			}
3627 			bp = nextp;
3628 		}
3629 	}
3630 	/*
3631 	 * Finally, if we received all the cipher text data for
3632 	 * this message, decrypt it into a new msg and send it up
3633 	 * to the app.
3634 	 */
3635 	if (tmi->rcmd_state.pt_len > 0 &&
3636 	    MBLKL(tmi->rcmd_state.c_msg) == tmi->rcmd_state.cd_len) {
3637 		mblk_t *bp;
3638 		mblk_t *newbp;
3639 
3640 		/*
3641 		 * Now we can use our msg that we created when the
3642 		 * initial message boundary was detected.
3643 		 */
3644 		bp = tmi->rcmd_state.c_msg;
3645 		tmi->rcmd_state.c_msg = NULL;
3646 
3647 		newbp = do_decrypt(q, bp);
3648 		if (newbp != NULL) {
3649 			bp = newbp;
3650 			/*
3651 			 * If using RCMD_MODE_V2 ("new" mode),
3652 			 * look at the 4 byte plaintext length that
3653 			 * was just decrypted and compare with the
3654 			 * original pt_len value that was received.
3655 			 */
3656 			if (tmi->dec_data.option_mask &
3657 			    CRYPTOPT_RCMD_MODE_V2) {
3658 				uint32_t pt_len2;
3659 
3660 				pt_len2 = *(uint32_t *)bp->b_rptr;
3661 				pt_len2 = ntohl(pt_len2);
3662 				/*
3663 				 * Make sure the 2 pt len fields agree.
3664 				 */
3665 				if (pt_len2 != tmi->rcmd_state.pt_len) {
3666 					cmn_err(CE_WARN,
3667 						"Inconsistent length fields"
3668 						" received %d != %d",
3669 						(int)tmi->rcmd_state.pt_len,
3670 						(int)pt_len2);
3671 					bp->b_datap->db_type = M_ERROR;
3672 					bp->b_rptr = bp->b_datap->db_base;
3673 					*bp->b_rptr = EIO;
3674 					bp->b_wptr = bp->b_rptr + sizeof (char);
3675 					freemsg(bp->b_cont);
3676 					bp->b_cont = NULL;
3677 					tmi->rcmd_state.cd_len = 0;
3678 					qreply(WR(q), bp);
3679 					return (NULL);
3680 				}
3681 				bp->b_rptr += sizeof (uint32_t);
3682 			}
3683 
3684 			/*
3685 			 * Trim the decrypted block the length originally
3686 			 * indicated by the sender.  This is to remove any
3687 			 * padding bytes that the sender added to satisfy
3688 			 * requirements of the crypto algorithm.
3689 			 */
3690 			bp->b_wptr = bp->b_rptr + tmi->rcmd_state.pt_len;
3691 
3692 			newmp = bp;
3693 
3694 			/*
3695 			 * Reset our state to indicate we are ready
3696 			 * for a new message.
3697 			 */
3698 			tmi->rcmd_state.pt_len = 0;
3699 			tmi->rcmd_state.cd_len = 0;
3700 		} else {
3701 #ifdef DEBUG
3702 			cmn_err(CE_WARN,
3703 				"decrypt_rcmd: do_decrypt on %d bytes failed",
3704 				(int)tmi->rcmd_state.cd_len);
3705 #endif
3706 			/*
3707 			 * do_decrypt already handled failures, just
3708 			 * return NULL.
3709 			 */
3710 			tmi->rcmd_state.pt_len = 0;
3711 			tmi->rcmd_state.cd_len = 0;
3712 			return (NULL);
3713 		}
3714 	}
3715 
3716 	/*
3717 	 * return the new message with the 'length' fields removed
3718 	 */
3719 	return (newmp);
3720 }
3721 
3722 /*
3723  * cryptmodrsrv
3724  *
3725  * Read queue service routine
3726  * Necessary because if the ready flag is not set
3727  * (via CRYPTIOCSTOP/CRYPTIOCSTART ioctls) then the data
3728  * must remain on queue and not be passed along.
3729  */
3730 static int
3731 cryptmodrsrv(queue_t *q)
3732 {
3733 	mblk_t *mp, *bp;
3734 	struct tmodinfo *tmi = (struct tmodinfo *)q->q_ptr;
3735 
3736 	while ((mp = getq(q)) != NULL) {
3737 		switch (mp->b_datap->db_type) {
3738 		case M_DATA:
3739 			if (canputnext(q) && tmi->ready & CRYPT_READ_READY) {
3740 				/*
3741 				 * Process "rcmd" messages differently because
3742 				 * they contain a 4 byte plaintext length
3743 				 * id that needs to be removed.
3744 				 */
3745 				if (tmi->dec_data.method != CRYPT_METHOD_NONE &&
3746 				    (tmi->dec_data.option_mask &
3747 				    (CRYPTOPT_RCMD_MODE_V1 |
3748 				    CRYPTOPT_RCMD_MODE_V2))) {
3749 					mp = decrypt_rcmd_mblks(q, mp);
3750 					if (mp)
3751 						putnext(q, mp);
3752 					continue;
3753 				}
3754 				if ((bp = msgpullup(mp, -1)) != NULL) {
3755 					freemsg(mp);
3756 					if (MBLKL(bp) > 0) {
3757 						mp = do_decrypt(q, bp);
3758 						if (mp != NULL)
3759 							putnext(q, mp);
3760 					}
3761 				}
3762 			} else {
3763 				if (!putbq(q, mp)) {
3764 					freemsg(mp);
3765 				}
3766 				return (0);
3767 			}
3768 			break;
3769 		default:
3770 			/*
3771 			 * rput does not queue anything > QPCTL, so we don't
3772 			 * need to check for it here.
3773 			 */
3774 			if (!canputnext(q)) {
3775 				if (!putbq(q, mp))
3776 					freemsg(mp);
3777 				return (0);
3778 			}
3779 			putnext(q, mp);
3780 			break;
3781 		}
3782 	}
3783 	return (0);
3784 }
3785 
3786 
3787 /*
3788  * Read-side put procedure.
3789  */
3790 static void
3791 cryptmodrput(queue_t *rq, mblk_t *mp)
3792 {
3793 	switch (mp->b_datap->db_type) {
3794 	case M_DATA:
3795 		if (!putq(rq, mp)) {
3796 			freemsg(mp);
3797 		}
3798 		break;
3799 	case M_FLUSH:
3800 		if (*mp->b_rptr & FLUSHR) {
3801 			flushq(rq, FLUSHALL);
3802 		}
3803 		putnext(rq, mp);
3804 		break;
3805 	default:
3806 		if (queclass(mp) < QPCTL) {
3807 			if (rq->q_first != NULL || !canputnext(rq)) {
3808 				if (!putq(rq, mp))
3809 					freemsg(mp);
3810 				return;
3811 			}
3812 		}
3813 		putnext(rq, mp);
3814 		break;
3815 	}
3816 }
3817