xref: /netbsd-src/sys/opencrypto/cryptosoft.c (revision b75abedac4cde97d49b0cc16fbe175dca459b84d)
1 /*	$NetBSD: cryptosoft.c,v 1.1 2003/07/25 21:12:45 jonathan Exp $ */
2 /*	$FreeBSD: src/sys/opencrypto/cryptosoft.c,v 1.2.2.1 2002/11/21 23:34:23 sam Exp $	*/
3 /*	$OpenBSD: cryptosoft.c,v 1.35 2002/04/26 08:43:50 deraadt Exp $	*/
4 
5 /*
6  * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
7  *
8  * This code was written by Angelos D. Keromytis in Athens, Greece, in
9  * February 2000. Network Security Technologies Inc. (NSTI) kindly
10  * supported the development of this code.
11  *
12  * Copyright (c) 2000, 2001 Angelos D. Keromytis
13  *
14  * Permission to use, copy, and modify this software with or without fee
15  * is hereby granted, provided that this entire notice is included in
16  * all source code copies of any software which is or includes a copy or
17  * modification of this software.
18  *
19  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
20  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
21  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
22  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
23  * PURPOSE.
24  */
25 
26 #include <sys/cdefs.h>
27 __KERNEL_RCSID(0, "$NetBSD: cryptosoft.c,v 1.1 2003/07/25 21:12:45 jonathan Exp $");
28 
29 #include <sys/param.h>
30 #include <sys/systm.h>
31 #include <sys/malloc.h>
32 #include <sys/mbuf.h>
33 #include <sys/sysctl.h>
34 #include <sys/errno.h>
35 #include <sys/md5k.h>
36 #include <sys/sha1.h>
37 #include <dev/rndvar.h>
38 #include <opencrypto/rmd160.h>
39 #include <opencrypto/cast.h>
40 #include <opencrypto/skipjack.h>
41 #include <opencrypto/blf.h>
42 #include <opencrypto/cryptodev.h>
43 #include <opencrypto/cryptosoft.h>
44 #include <opencrypto/xform.h>
45 
46 u_int8_t hmac_ipad_buffer[64] = {
47 	0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
48 	0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
49 	0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
50 	0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
51 	0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
52 	0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
53 	0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
54 	0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36
55 };
56 
57 u_int8_t hmac_opad_buffer[64] = {
58 	0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C,
59 	0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C,
60 	0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C,
61 	0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C,
62 	0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C,
63 	0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C,
64 	0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C,
65 	0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C, 0x5C
66 };
67 
68 
69 struct swcr_data **swcr_sessions = NULL;
70 u_int32_t swcr_sesnum = 0;
71 int32_t swcr_id = -1;
72 
73 #define COPYBACK(x, a, b, c, d) \
74 	(x) == CRYPTO_BUF_MBUF ? m_copyback((struct mbuf *)a,b,c,d) \
75 	: cuio_copyback((struct uio *)a,b,c,d)
76 #define COPYDATA(x, a, b, c, d) \
77 	(x) == CRYPTO_BUF_MBUF ? m_copydata((struct mbuf *)a,b,c,d) \
78 	: cuio_copydata((struct uio *)a,b,c,d)
79 
80 static	int swcr_encdec(struct cryptodesc *, struct swcr_data *, caddr_t, int);
81 static	int swcr_authcompute(struct cryptop *crp, struct cryptodesc *crd,
82 			     struct swcr_data *sw, caddr_t buf, int outtype);
83 static	int swcr_compdec(struct cryptodesc *, struct swcr_data *, caddr_t, int);
84 static	int swcr_process(void *, struct cryptop *, int);
85 static	int swcr_newsession(void *, u_int32_t *, struct cryptoini *);
86 static	int swcr_freesession(void *, u_int64_t);
87 
88 /*
89  * NB: These came over from openbsd and are kept private
90  *     to the crypto code for now.
91  */
92 extern	int m_apply(struct mbuf *m, int off, int len,
93 		    int (*f)(caddr_t, caddr_t, unsigned int), caddr_t fstate);
94 
95 /*
96  * Apply a symmetric encryption/decryption algorithm.
97  */
98 static int
99 swcr_encdec(struct cryptodesc *crd, struct swcr_data *sw, caddr_t buf,
100     int outtype)
101 {
102 	unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN], *idat;
103 	unsigned char *ivp, piv[EALG_MAX_BLOCK_LEN];
104 	struct enc_xform *exf;
105 	int i, k, j, blks;
106 	int count, ind;
107 
108 	exf = sw->sw_exf;
109 	blks = exf->blocksize;
110 
111 	/* Check for non-padded data */
112 	if (crd->crd_len % blks)
113 		return EINVAL;
114 
115 	/* Initialize the IV */
116 	if (crd->crd_flags & CRD_F_ENCRYPT) {
117 		/* IV explicitly provided ? */
118 		if (crd->crd_flags & CRD_F_IV_EXPLICIT)
119 			bcopy(crd->crd_iv, iv, blks);
120 		else {
121 			/* Get random IV */
122 			for (i = 0;
123 			    i + sizeof (u_int32_t) < EALG_MAX_BLOCK_LEN;
124 			    i += sizeof (u_int32_t)) {
125 				u_int32_t temp = arc4random();
126 
127 				bcopy(&temp, iv + i, sizeof(u_int32_t));
128 			}
129 			/*
130 			 * What if the block size is not a multiple
131 			 * of sizeof (u_int32_t), which is the size of
132 			 * what arc4random() returns ?
133 			 */
134 			if (EALG_MAX_BLOCK_LEN % sizeof (u_int32_t) != 0) {
135 				u_int32_t temp = arc4random();
136 
137 				bcopy (&temp, iv + i,
138 				    EALG_MAX_BLOCK_LEN - i);
139 			}
140 		}
141 
142 		/* Do we need to write the IV */
143 		if (!(crd->crd_flags & CRD_F_IV_PRESENT)) {
144 			COPYBACK(outtype, buf, crd->crd_inject, blks, iv);
145 		}
146 
147 	} else {	/* Decryption */
148 			/* IV explicitly provided ? */
149 		if (crd->crd_flags & CRD_F_IV_EXPLICIT)
150 			bcopy(crd->crd_iv, iv, blks);
151 		else {
152 			/* Get IV off buf */
153 			COPYDATA(outtype, buf, crd->crd_inject, blks, iv);
154 		}
155 	}
156 
157 	ivp = iv;
158 
159 	if (outtype == CRYPTO_BUF_CONTIG) {
160 		if (crd->crd_flags & CRD_F_ENCRYPT) {
161 			for (i = crd->crd_skip;
162 			    i < crd->crd_skip + crd->crd_len; i += blks) {
163 				/* XOR with the IV/previous block, as appropriate. */
164 				if (i == crd->crd_skip)
165 					for (k = 0; k < blks; k++)
166 						buf[i + k] ^= ivp[k];
167 				else
168 					for (k = 0; k < blks; k++)
169 						buf[i + k] ^= buf[i + k - blks];
170 				exf->encrypt(sw->sw_kschedule, buf + i);
171 			}
172 		} else {		/* Decrypt */
173 			/*
174 			 * Start at the end, so we don't need to keep the encrypted
175 			 * block as the IV for the next block.
176 			 */
177 			for (i = crd->crd_skip + crd->crd_len - blks;
178 			    i >= crd->crd_skip; i -= blks) {
179 				exf->decrypt(sw->sw_kschedule, buf + i);
180 
181 				/* XOR with the IV/previous block, as appropriate */
182 				if (i == crd->crd_skip)
183 					for (k = 0; k < blks; k++)
184 						buf[i + k] ^= ivp[k];
185 				else
186 					for (k = 0; k < blks; k++)
187 						buf[i + k] ^= buf[i + k - blks];
188 			}
189 		}
190 
191 		return 0;
192 	} else if (outtype == CRYPTO_BUF_MBUF) {
193 		struct mbuf *m = (struct mbuf *) buf;
194 
195 		/* Find beginning of data */
196 		m = m_getptr(m, crd->crd_skip, &k);
197 		if (m == NULL)
198 			return EINVAL;
199 
200 		i = crd->crd_len;
201 
202 		while (i > 0) {
203 			/*
204 			 * If there's insufficient data at the end of
205 			 * an mbuf, we have to do some copying.
206 			 */
207 			if (m->m_len < k + blks && m->m_len != k) {
208 				m_copydata(m, k, blks, blk);
209 
210 				/* Actual encryption/decryption */
211 				if (crd->crd_flags & CRD_F_ENCRYPT) {
212 					/* XOR with previous block */
213 					for (j = 0; j < blks; j++)
214 						blk[j] ^= ivp[j];
215 
216 					exf->encrypt(sw->sw_kschedule, blk);
217 
218 					/*
219 					 * Keep encrypted block for XOR'ing
220 					 * with next block
221 					 */
222 					bcopy(blk, iv, blks);
223 					ivp = iv;
224 				} else {	/* decrypt */
225 					/*
226 					 * Keep encrypted block for XOR'ing
227 					 * with next block
228 					 */
229 					if (ivp == iv)
230 						bcopy(blk, piv, blks);
231 					else
232 						bcopy(blk, iv, blks);
233 
234 					exf->decrypt(sw->sw_kschedule, blk);
235 
236 					/* XOR with previous block */
237 					for (j = 0; j < blks; j++)
238 						blk[j] ^= ivp[j];
239 
240 					if (ivp == iv)
241 						bcopy(piv, iv, blks);
242 					else
243 						ivp = iv;
244 				}
245 
246 				/* Copy back decrypted block */
247 				m_copyback(m, k, blks, blk);
248 
249 				/* Advance pointer */
250 				m = m_getptr(m, k + blks, &k);
251 				if (m == NULL)
252 					return EINVAL;
253 
254 				i -= blks;
255 
256 				/* Could be done... */
257 				if (i == 0)
258 					break;
259 			}
260 
261 			/* Skip possibly empty mbufs */
262 			if (k == m->m_len) {
263 				for (m = m->m_next; m && m->m_len == 0;
264 				    m = m->m_next)
265 					;
266 				k = 0;
267 			}
268 
269 			/* Sanity check */
270 			if (m == NULL)
271 				return EINVAL;
272 
273 			/*
274 			 * Warning: idat may point to garbage here, but
275 			 * we only use it in the while() loop, only if
276 			 * there are indeed enough data.
277 			 */
278 			idat = mtod(m, unsigned char *) + k;
279 
280 			while (m->m_len >= k + blks && i > 0) {
281 				if (crd->crd_flags & CRD_F_ENCRYPT) {
282 					/* XOR with previous block/IV */
283 					for (j = 0; j < blks; j++)
284 						idat[j] ^= ivp[j];
285 
286 					exf->encrypt(sw->sw_kschedule, idat);
287 					ivp = idat;
288 				} else {	/* decrypt */
289 					/*
290 					 * Keep encrypted block to be used
291 					 * in next block's processing.
292 					 */
293 					if (ivp == iv)
294 						bcopy(idat, piv, blks);
295 					else
296 						bcopy(idat, iv, blks);
297 
298 					exf->decrypt(sw->sw_kschedule, idat);
299 
300 					/* XOR with previous block/IV */
301 					for (j = 0; j < blks; j++)
302 						idat[j] ^= ivp[j];
303 
304 					if (ivp == iv)
305 						bcopy(piv, iv, blks);
306 					else
307 						ivp = iv;
308 				}
309 
310 				idat += blks;
311 				k += blks;
312 				i -= blks;
313 			}
314 		}
315 
316 		return 0; /* Done with mbuf encryption/decryption */
317 	} else if (outtype == CRYPTO_BUF_IOV) {
318 		struct uio *uio = (struct uio *) buf;
319 
320 #ifdef __FreeBSD__
321 		struct iovec *iov;
322 		/* Find beginning of data */
323 		iov = cuio_getptr(uio, crd->crd_skip, &k);
324 		if (iov == NULL)
325 			return EINVAL;
326 
327 		i = crd->crd_len;
328 
329 		while (i > 0) {
330 			/*
331 			 * If there's insufficient data at the end of
332 			 * an iovec, we have to do some copying.
333 			 */
334 			if (iov->iov_len < k + blks && iov->iov_len != k) {
335 				cuio_copydata(uio, k, blks, blk);
336 
337 				/* Actual encryption/decryption */
338 				if (crd->crd_flags & CRD_F_ENCRYPT) {
339 					/* XOR with previous block */
340 					for (j = 0; j < blks; j++)
341 						blk[j] ^= ivp[j];
342 
343 					exf->encrypt(sw->sw_kschedule, blk);
344 
345 					/*
346 					 * Keep encrypted block for XOR'ing
347 					 * with next block
348 					 */
349 					bcopy(blk, iv, blks);
350 					ivp = iv;
351 				} else {	/* decrypt */
352 					/*
353 					 * Keep encrypted block for XOR'ing
354 					 * with next block
355 					 */
356 					if (ivp == iv)
357 						bcopy(blk, piv, blks);
358 					else
359 						bcopy(blk, iv, blks);
360 
361 					exf->decrypt(sw->sw_kschedule, blk);
362 
363 					/* XOR with previous block */
364 					for (j = 0; j < blks; j++)
365 						blk[j] ^= ivp[j];
366 
367 					if (ivp == iv)
368 						bcopy(piv, iv, blks);
369 					else
370 						ivp = iv;
371 				}
372 
373 				/* Copy back decrypted block */
374 				cuio_copyback(uio, k, blks, blk);
375 
376 				/* Advance pointer */
377 				iov = cuio_getptr(uio, k + blks, &k);
378 				if (iov == NULL)
379 					return EINVAL;
380 
381 				i -= blks;
382 
383 				/* Could be done... */
384 				if (i == 0)
385 					break;
386 			}
387 
388 			/*
389 			 * Warning: idat may point to garbage here, but
390 			 * we only use it in the while() loop, only if
391 			 * there are indeed enough data.
392 			 */
393 			idat = (char *)iov->iov_base + k;
394 
395 	   		while (iov->iov_len >= k + blks && i > 0) {
396 				if (crd->crd_flags & CRD_F_ENCRYPT) {
397 					/* XOR with previous block/IV */
398 					for (j = 0; j < blks; j++)
399 						idat[j] ^= ivp[j];
400 
401 					exf->encrypt(sw->sw_kschedule, idat);
402 					ivp = idat;
403 				} else {	/* decrypt */
404 					/*
405 					 * Keep encrypted block to be used
406 					 * in next block's processing.
407 					 */
408 					if (ivp == iv)
409 						bcopy(idat, piv, blks);
410 					else
411 						bcopy(idat, iv, blks);
412 
413 					exf->decrypt(sw->sw_kschedule, idat);
414 
415 					/* XOR with previous block/IV */
416 					for (j = 0; j < blks; j++)
417 						idat[j] ^= ivp[j];
418 
419 					if (ivp == iv)
420 						bcopy(piv, iv, blks);
421 					else
422 						ivp = iv;
423 				}
424 
425 				idat += blks;
426 				k += blks;
427 				i -= blks;
428 			}
429 		}
430 
431 		return 0; /* Done with mbuf encryption/decryption */
432 #else  /* !freebsd iov */
433 		/* Find beginning of data */
434 		count = crd->crd_skip;
435 		ind = cuio_getptr(uio, count, &k);
436 		if (ind == -1)
437 			return EINVAL;
438 
439 		i = crd->crd_len;
440 
441 		while (i > 0) {
442 			/*
443 			 * If there's insufficient data at the end,
444 			 * we have to do some copying.
445 			 */
446 			if (uio->uio_iov[ind].iov_len < k + blks &&
447 			    uio->uio_iov[ind].iov_len != k) {
448 				cuio_copydata(uio, k, blks, blk);
449 
450 				/* Actual encryption/decryption */
451 				if (crd->crd_flags & CRD_F_ENCRYPT) {
452 					/* XOR with previous block */
453 					for (j = 0; j < blks; j++)
454 						blk[j] ^= ivp[j];
455 
456 					exf->encrypt(sw->sw_kschedule, blk);
457 
458 					/*
459 					 * Keep encrypted block for XOR'ing
460 					 * with next block
461 					 */
462 					bcopy(blk, iv, blks);
463 					ivp = iv;
464 				} else {	/* decrypt */
465 					/*
466 					 * Keep encrypted block for XOR'ing
467 					 * with next block
468 					 */
469 					if (ivp == iv)
470 						bcopy(blk, piv, blks);
471 					else
472 						bcopy(blk, iv, blks);
473 
474 					exf->decrypt(sw->sw_kschedule, blk);
475 
476 					/* XOR with previous block */
477 					for (j = 0; j < blks; j++)
478 						blk[j] ^= ivp[j];
479 
480 					if (ivp == iv)
481 						bcopy(piv, iv, blks);
482 					else
483 						ivp = iv;
484 				}
485 
486 				/* Copy back decrypted block */
487 				cuio_copyback(uio, k, blks, blk);
488 
489 				count += blks;
490 
491 				/* Advance pointer */
492 				ind = cuio_getptr(uio, count, &k);
493 				if (ind == -1)
494 					return (EINVAL);
495 
496 				i -= blks;
497 
498 				/* Could be done... */
499 				if (i == 0)
500 					break;
501 			}
502 
503 			/*
504 			 * Warning: idat may point to garbage here, but
505 			 * we only use it in the while() loop, only if
506 			 * there are indeed enough data.
507 			 */
508 			idat = ((caddr_t)uio->uio_iov[ind].iov_base) + k;
509 
510 			while (uio->uio_iov[ind].iov_len >= k + blks &&
511 			    i > 0) {
512 				if (crd->crd_flags & CRD_F_ENCRYPT) {
513 					/* XOR with previous block/IV */
514 					for (j = 0; j < blks; j++)
515 						idat[j] ^= ivp[j];
516 
517 					exf->encrypt(sw->sw_kschedule, idat);
518 					ivp = idat;
519 				} else {	/* decrypt */
520 					/*
521 					 * Keep encrypted block to be used
522 					 * in next block's processing.
523 					 */
524 					if (ivp == iv)
525 						bcopy(idat, piv, blks);
526 					else
527 						bcopy(idat, iv, blks);
528 
529 					exf->decrypt(sw->sw_kschedule, idat);
530 
531 					/* XOR with previous block/IV */
532 					for (j = 0; j < blks; j++)
533 						idat[j] ^= ivp[j];
534 
535 					if (ivp == iv)
536 						bcopy(piv, iv, blks);
537 					else
538 						ivp = iv;
539 				}
540 
541 				idat += blks;
542 				count += blks;
543 				k += blks;
544 				i -= blks;
545 			}
546 		}
547 #endif
548 		return 0; /* Done with mbuf encryption/decryption */
549 	}
550 
551 	/* Unreachable */
552 	return EINVAL;
553 }
554 
555 /*
556  * Compute keyed-hash authenticator.
557  */
558 static int
559 swcr_authcompute(struct cryptop *crp, struct cryptodesc *crd,
560     struct swcr_data *sw, caddr_t buf, int outtype)
561 {
562 	unsigned char aalg[AALG_MAX_RESULT_LEN];
563 	struct auth_hash *axf;
564 	union authctx ctx;
565 	int err;
566 
567 	if (sw->sw_ictx == 0)
568 		return EINVAL;
569 
570 	axf = sw->sw_axf;
571 
572 	bcopy(sw->sw_ictx, &ctx, axf->ctxsize);
573 
574 	switch (outtype) {
575 	case CRYPTO_BUF_CONTIG:
576 		axf->Update(&ctx, buf + crd->crd_skip, crd->crd_len);
577 		break;
578 	case CRYPTO_BUF_MBUF:
579 		err = m_apply((struct mbuf *) buf, crd->crd_skip, crd->crd_len,
580 		    (int (*)(caddr_t, caddr_t, unsigned int)) axf->Update,
581 		    (caddr_t) &ctx);
582 		if (err)
583 			return err;
584 		break;
585 	case CRYPTO_BUF_IOV:
586 	default:
587 		return EINVAL;
588 	}
589 
590 	switch (sw->sw_alg) {
591 	case CRYPTO_MD5_HMAC:
592 	case CRYPTO_SHA1_HMAC:
593 	case CRYPTO_SHA2_HMAC:
594 	case CRYPTO_RIPEMD160_HMAC:
595 		if (sw->sw_octx == NULL)
596 			return EINVAL;
597 
598 		axf->Final(aalg, &ctx);
599 		bcopy(sw->sw_octx, &ctx, axf->ctxsize);
600 		axf->Update(&ctx, aalg, axf->hashsize);
601 		axf->Final(aalg, &ctx);
602 		break;
603 
604 	case CRYPTO_MD5_KPDK:
605 	case CRYPTO_SHA1_KPDK:
606 		if (sw->sw_octx == NULL)
607 			return EINVAL;
608 
609 		axf->Update(&ctx, sw->sw_octx, sw->sw_klen);
610 		axf->Final(aalg, &ctx);
611 		break;
612 
613 	case CRYPTO_NULL_HMAC:
614 	case CRYPTO_MD5:
615 	case CRYPTO_SHA1:
616 		axf->Final(aalg, &ctx);
617 		break;
618 	}
619 
620 	/* Inject the authentication data */
621 	if (outtype == CRYPTO_BUF_CONTIG)
622 		bcopy(aalg, buf + crd->crd_inject, axf->authsize);
623 	else
624 		m_copyback((struct mbuf *) buf, crd->crd_inject,
625 		    axf->authsize, aalg);
626 	return 0;
627 }
628 
629 /*
630  * Apply a compression/decompression algorithm
631  */
632 static int
633 swcr_compdec(struct cryptodesc *crd, struct swcr_data *sw,
634     caddr_t buf, int outtype)
635 {
636 	u_int8_t *data, *out;
637 	struct comp_algo *cxf;
638 	int adj;
639 	u_int32_t result;
640 
641 	cxf = sw->sw_cxf;
642 
643 	/* We must handle the whole buffer of data in one time
644 	 * then if there is not all the data in the mbuf, we must
645 	 * copy in a buffer.
646 	 */
647 
648 	MALLOC(data, u_int8_t *, crd->crd_len, M_CRYPTO_DATA,  M_NOWAIT);
649 	if (data == NULL)
650 		return (EINVAL);
651 	COPYDATA(outtype, buf, crd->crd_skip, crd->crd_len, data);
652 
653 	if (crd->crd_flags & CRD_F_COMP)
654 		result = cxf->compress(data, crd->crd_len, &out);
655 	else
656 		result = cxf->decompress(data, crd->crd_len, &out);
657 
658 	FREE(data, M_CRYPTO_DATA);
659 	if (result == 0)
660 		return EINVAL;
661 
662 	/* Copy back the (de)compressed data. m_copyback is
663 	 * extending the mbuf as necessary.
664 	 */
665 	sw->sw_size = result;
666 	/* Check the compressed size when doing compression */
667 	if (crd->crd_flags & CRD_F_COMP) {
668 		if (result > crd->crd_len) {
669 			/* Compression was useless, we lost time */
670 			FREE(out, M_CRYPTO_DATA);
671 			return 0;
672 		}
673 	}
674 
675 	COPYBACK(outtype, buf, crd->crd_skip, result, out);
676 	if (result < crd->crd_len) {
677 		adj = result - crd->crd_len;
678 		if (outtype == CRYPTO_BUF_MBUF) {
679 			adj = result - crd->crd_len;
680 			m_adj((struct mbuf *)buf, adj);
681 		} else {
682 			struct uio *uio = (struct uio *)buf;
683 			int ind;
684 
685 			adj = crd->crd_len - result;
686 			ind = uio->uio_iovcnt - 1;
687 
688 			while (adj > 0 && ind >= 0) {
689 				if (adj < uio->uio_iov[ind].iov_len) {
690 					uio->uio_iov[ind].iov_len -= adj;
691 					break;
692 				}
693 
694 				adj -= uio->uio_iov[ind].iov_len;
695 				uio->uio_iov[ind].iov_len = 0;
696 				ind--;
697 				uio->uio_iovcnt--;
698 			}
699 		}
700 	}
701 	FREE(out, M_CRYPTO_DATA);
702 	return 0;
703 }
704 
705 /*
706  * Generate a new software session.
707  */
708 static int
709 swcr_newsession(void *arg, u_int32_t *sid, struct cryptoini *cri)
710 {
711 	struct swcr_data **swd;
712 	struct auth_hash *axf;
713 	struct enc_xform *txf;
714 	struct comp_algo *cxf;
715 	u_int32_t i;
716 	int k, error;
717 
718 	if (sid == NULL || cri == NULL)
719 		return EINVAL;
720 
721 	if (swcr_sessions) {
722 		for (i = 1; i < swcr_sesnum; i++)
723 			if (swcr_sessions[i] == NULL)
724 				break;
725 	} else
726 		i = 1;		/* NB: to silence compiler warning */
727 
728 	if (swcr_sessions == NULL || i == swcr_sesnum) {
729 		if (swcr_sessions == NULL) {
730 			i = 1; /* We leave swcr_sessions[0] empty */
731 			swcr_sesnum = CRYPTO_SW_SESSIONS;
732 		} else
733 			swcr_sesnum *= 2;
734 
735 		swd = malloc(swcr_sesnum * sizeof(struct swcr_data *),
736 		    M_CRYPTO_DATA, M_NOWAIT);
737 		if (swd == NULL) {
738 			/* Reset session number */
739 			if (swcr_sesnum == CRYPTO_SW_SESSIONS)
740 				swcr_sesnum = 0;
741 			else
742 				swcr_sesnum /= 2;
743 			return ENOBUFS;
744 		}
745 
746 		bzero(swd, swcr_sesnum * sizeof(struct swcr_data *));
747 
748 		/* Copy existing sessions */
749 		if (swcr_sessions) {
750 			bcopy(swcr_sessions, swd,
751 			    (swcr_sesnum / 2) * sizeof(struct swcr_data *));
752 			free(swcr_sessions, M_CRYPTO_DATA);
753 		}
754 
755 		swcr_sessions = swd;
756 	}
757 
758 	swd = &swcr_sessions[i];
759 	*sid = i;
760 
761 	while (cri) {
762 		MALLOC(*swd, struct swcr_data *, sizeof(struct swcr_data),
763 		    M_CRYPTO_DATA, M_NOWAIT);
764 		if (*swd == NULL) {
765 			swcr_freesession(NULL, i);
766 			return ENOBUFS;
767 		}
768 		bzero(*swd, sizeof(struct swcr_data));
769 
770 		switch (cri->cri_alg) {
771 		case CRYPTO_DES_CBC:
772 			txf = &enc_xform_des;
773 			goto enccommon;
774 		case CRYPTO_3DES_CBC:
775 			txf = &enc_xform_3des;
776 			goto enccommon;
777 		case CRYPTO_BLF_CBC:
778 			txf = &enc_xform_blf;
779 			goto enccommon;
780 		case CRYPTO_CAST_CBC:
781 			txf = &enc_xform_cast5;
782 			goto enccommon;
783 		case CRYPTO_SKIPJACK_CBC:
784 			txf = &enc_xform_skipjack;
785 			goto enccommon;
786 		case CRYPTO_RIJNDAEL128_CBC:
787 			txf = &enc_xform_rijndael128;
788 			goto enccommon;
789 		case CRYPTO_NULL_CBC:
790 			txf = &enc_xform_null;
791 			goto enccommon;
792 		enccommon:
793 			error = txf->setkey(&((*swd)->sw_kschedule),
794 					cri->cri_key, cri->cri_klen / 8);
795 			if (error) {
796 				swcr_freesession(NULL, i);
797 				return error;
798 			}
799 			(*swd)->sw_exf = txf;
800 			break;
801 
802 		case CRYPTO_MD5_HMAC:
803 			axf = &auth_hash_hmac_md5_96;
804 			goto authcommon;
805 		case CRYPTO_SHA1_HMAC:
806 			axf = &auth_hash_hmac_sha1_96;
807 			goto authcommon;
808 		case CRYPTO_SHA2_HMAC:
809 			if (cri->cri_klen == 256)
810 				axf = &auth_hash_hmac_sha2_256;
811 			else if (cri->cri_klen == 384)
812 				axf = &auth_hash_hmac_sha2_384;
813 			else if (cri->cri_klen == 512)
814 				axf = &auth_hash_hmac_sha2_512;
815 			else {
816 				swcr_freesession(NULL, i);
817 				return EINVAL;
818 			}
819 			goto authcommon;
820 		case CRYPTO_NULL_HMAC:
821 			axf = &auth_hash_null;
822 			goto authcommon;
823 		case CRYPTO_RIPEMD160_HMAC:
824 			axf = &auth_hash_hmac_ripemd_160_96;
825 		authcommon:
826 			(*swd)->sw_ictx = malloc(axf->ctxsize, M_CRYPTO_DATA,
827 			    M_NOWAIT);
828 			if ((*swd)->sw_ictx == NULL) {
829 				swcr_freesession(NULL, i);
830 				return ENOBUFS;
831 			}
832 
833 			(*swd)->sw_octx = malloc(axf->ctxsize, M_CRYPTO_DATA,
834 			    M_NOWAIT);
835 			if ((*swd)->sw_octx == NULL) {
836 				swcr_freesession(NULL, i);
837 				return ENOBUFS;
838 			}
839 
840 			for (k = 0; k < cri->cri_klen / 8; k++)
841 				cri->cri_key[k] ^= HMAC_IPAD_VAL;
842 
843 			axf->Init((*swd)->sw_ictx);
844 			axf->Update((*swd)->sw_ictx, cri->cri_key,
845 			    cri->cri_klen / 8);
846 			axf->Update((*swd)->sw_ictx, hmac_ipad_buffer,
847 			    HMAC_BLOCK_LEN - (cri->cri_klen / 8));
848 
849 			for (k = 0; k < cri->cri_klen / 8; k++)
850 				cri->cri_key[k] ^= (HMAC_IPAD_VAL ^ HMAC_OPAD_VAL);
851 
852 			axf->Init((*swd)->sw_octx);
853 			axf->Update((*swd)->sw_octx, cri->cri_key,
854 			    cri->cri_klen / 8);
855 			axf->Update((*swd)->sw_octx, hmac_opad_buffer,
856 			    HMAC_BLOCK_LEN - (cri->cri_klen / 8));
857 
858 			for (k = 0; k < cri->cri_klen / 8; k++)
859 				cri->cri_key[k] ^= HMAC_OPAD_VAL;
860 			(*swd)->sw_axf = axf;
861 			break;
862 
863 		case CRYPTO_MD5_KPDK:
864 			axf = &auth_hash_key_md5;
865 			goto auth2common;
866 
867 		case CRYPTO_SHA1_KPDK:
868 			axf = &auth_hash_key_sha1;
869 		auth2common:
870 			(*swd)->sw_ictx = malloc(axf->ctxsize, M_CRYPTO_DATA,
871 			    M_NOWAIT);
872 			if ((*swd)->sw_ictx == NULL) {
873 				swcr_freesession(NULL, i);
874 				return ENOBUFS;
875 			}
876 
877 			/* Store the key so we can "append" it to the payload */
878 			(*swd)->sw_octx = malloc(cri->cri_klen / 8, M_CRYPTO_DATA,
879 			    M_NOWAIT);
880 			if ((*swd)->sw_octx == NULL) {
881 				swcr_freesession(NULL, i);
882 				return ENOBUFS;
883 			}
884 
885 			(*swd)->sw_klen = cri->cri_klen / 8;
886 			bcopy(cri->cri_key, (*swd)->sw_octx, cri->cri_klen / 8);
887 			axf->Init((*swd)->sw_ictx);
888 			axf->Update((*swd)->sw_ictx, cri->cri_key,
889 			    cri->cri_klen / 8);
890 			axf->Final(NULL, (*swd)->sw_ictx);
891 			(*swd)->sw_axf = axf;
892 			break;
893 
894 		case CRYPTO_MD5:
895 			axf = &auth_hash_md5;
896 			goto auth3common;
897 
898 		case CRYPTO_SHA1:
899 			axf = &auth_hash_sha1;
900 		auth3common:
901 			(*swd)->sw_ictx = malloc(axf->ctxsize, M_CRYPTO_DATA,
902 			    M_NOWAIT);
903 			if ((*swd)->sw_ictx == NULL) {
904 				swcr_freesession(NULL, i);
905 				return ENOBUFS;
906 			}
907 
908 			axf->Init((*swd)->sw_ictx);
909 			(*swd)->sw_axf = axf;
910 			break;
911 
912 		case CRYPTO_DEFLATE_COMP:
913 			cxf = &comp_algo_deflate;
914 			(*swd)->sw_cxf = cxf;
915 			break;
916 		default:
917 			swcr_freesession(NULL, i);
918 			return EINVAL;
919 		}
920 
921 		(*swd)->sw_alg = cri->cri_alg;
922 		cri = cri->cri_next;
923 		swd = &((*swd)->sw_next);
924 	}
925 	return 0;
926 }
927 
928 /*
929  * Free a session.
930  */
931 static int
932 swcr_freesession(void *arg, u_int64_t tid)
933 {
934 	struct swcr_data *swd;
935 	struct enc_xform *txf;
936 	struct auth_hash *axf;
937 	struct comp_algo *cxf;
938 	u_int32_t sid = ((u_int32_t) tid) & 0xffffffff;
939 
940 	if (sid > swcr_sesnum || swcr_sessions == NULL ||
941 	    swcr_sessions[sid] == NULL)
942 		return EINVAL;
943 
944 	/* Silently accept and return */
945 	if (sid == 0)
946 		return 0;
947 
948 	while ((swd = swcr_sessions[sid]) != NULL) {
949 		swcr_sessions[sid] = swd->sw_next;
950 
951 		switch (swd->sw_alg) {
952 		case CRYPTO_DES_CBC:
953 		case CRYPTO_3DES_CBC:
954 		case CRYPTO_BLF_CBC:
955 		case CRYPTO_CAST_CBC:
956 		case CRYPTO_SKIPJACK_CBC:
957 		case CRYPTO_RIJNDAEL128_CBC:
958 		case CRYPTO_NULL_CBC:
959 			txf = swd->sw_exf;
960 
961 			if (swd->sw_kschedule)
962 				txf->zerokey(&(swd->sw_kschedule));
963 			break;
964 
965 		case CRYPTO_MD5_HMAC:
966 		case CRYPTO_SHA1_HMAC:
967 		case CRYPTO_SHA2_HMAC:
968 		case CRYPTO_RIPEMD160_HMAC:
969 		case CRYPTO_NULL_HMAC:
970 			axf = swd->sw_axf;
971 
972 			if (swd->sw_ictx) {
973 				bzero(swd->sw_ictx, axf->ctxsize);
974 				free(swd->sw_ictx, M_CRYPTO_DATA);
975 			}
976 			if (swd->sw_octx) {
977 				bzero(swd->sw_octx, axf->ctxsize);
978 				free(swd->sw_octx, M_CRYPTO_DATA);
979 			}
980 			break;
981 
982 		case CRYPTO_MD5_KPDK:
983 		case CRYPTO_SHA1_KPDK:
984 			axf = swd->sw_axf;
985 
986 			if (swd->sw_ictx) {
987 				bzero(swd->sw_ictx, axf->ctxsize);
988 				free(swd->sw_ictx, M_CRYPTO_DATA);
989 			}
990 			if (swd->sw_octx) {
991 				bzero(swd->sw_octx, swd->sw_klen);
992 				free(swd->sw_octx, M_CRYPTO_DATA);
993 			}
994 			break;
995 
996 		case CRYPTO_MD5:
997 		case CRYPTO_SHA1:
998 			axf = swd->sw_axf;
999 
1000 			if (swd->sw_ictx)
1001 				free(swd->sw_ictx, M_CRYPTO_DATA);
1002 			break;
1003 
1004 		case CRYPTO_DEFLATE_COMP:
1005 			cxf = swd->sw_cxf;
1006 			break;
1007 		}
1008 
1009 		FREE(swd, M_CRYPTO_DATA);
1010 	}
1011 	return 0;
1012 }
1013 
1014 /*
1015  * Process a software request.
1016  */
1017 static int
1018 swcr_process(void *arg, struct cryptop *crp, int hint)
1019 {
1020 	struct cryptodesc *crd;
1021 	struct swcr_data *sw;
1022 	u_int32_t lid;
1023 	int type;
1024 
1025 	/* Sanity check */
1026 	if (crp == NULL)
1027 		return EINVAL;
1028 
1029 	if (crp->crp_desc == NULL || crp->crp_buf == NULL) {
1030 		crp->crp_etype = EINVAL;
1031 		goto done;
1032 	}
1033 
1034 	lid = crp->crp_sid & 0xffffffff;
1035 	if (lid >= swcr_sesnum || lid == 0 || swcr_sessions[lid] == NULL) {
1036 		crp->crp_etype = ENOENT;
1037 		goto done;
1038 	}
1039 
1040 	if (crp->crp_flags & CRYPTO_F_IMBUF) {
1041 		type = CRYPTO_BUF_MBUF;
1042 	} else if (crp->crp_flags & CRYPTO_F_IOV) {
1043 		type = CRYPTO_BUF_IOV;
1044 	} else {
1045 		type = CRYPTO_BUF_CONTIG;
1046 	}
1047 
1048 	/* Go through crypto descriptors, processing as we go */
1049 	for (crd = crp->crp_desc; crd; crd = crd->crd_next) {
1050 		/*
1051 		 * Find the crypto context.
1052 		 *
1053 		 * XXX Note that the logic here prevents us from having
1054 		 * XXX the same algorithm multiple times in a session
1055 		 * XXX (or rather, we can but it won't give us the right
1056 		 * XXX results). To do that, we'd need some way of differentiating
1057 		 * XXX between the various instances of an algorithm (so we can
1058 		 * XXX locate the correct crypto context).
1059 		 */
1060 		for (sw = swcr_sessions[lid];
1061 		    sw && sw->sw_alg != crd->crd_alg;
1062 		    sw = sw->sw_next)
1063 			;
1064 
1065 		/* No such context ? */
1066 		if (sw == NULL) {
1067 			crp->crp_etype = EINVAL;
1068 			goto done;
1069 		}
1070 
1071 		switch (sw->sw_alg) {
1072 		case CRYPTO_DES_CBC:
1073 		case CRYPTO_3DES_CBC:
1074 		case CRYPTO_BLF_CBC:
1075 		case CRYPTO_CAST_CBC:
1076 		case CRYPTO_SKIPJACK_CBC:
1077 		case CRYPTO_RIJNDAEL128_CBC:
1078 			if ((crp->crp_etype = swcr_encdec(crd, sw,
1079 			    crp->crp_buf, type)) != 0)
1080 				goto done;
1081 			break;
1082 		case CRYPTO_NULL_CBC:
1083 			crp->crp_etype = 0;
1084 			break;
1085 		case CRYPTO_MD5_HMAC:
1086 		case CRYPTO_SHA1_HMAC:
1087 		case CRYPTO_SHA2_HMAC:
1088 		case CRYPTO_RIPEMD160_HMAC:
1089 		case CRYPTO_NULL_HMAC:
1090 		case CRYPTO_MD5_KPDK:
1091 		case CRYPTO_SHA1_KPDK:
1092 		case CRYPTO_MD5:
1093 		case CRYPTO_SHA1:
1094 			if ((crp->crp_etype = swcr_authcompute(crp, crd, sw,
1095 			    crp->crp_buf, type)) != 0)
1096 				goto done;
1097 			break;
1098 
1099 		case CRYPTO_DEFLATE_COMP:
1100 			if ((crp->crp_etype = swcr_compdec(crd, sw,
1101 			    crp->crp_buf, type)) != 0)
1102 				goto done;
1103 			else
1104 				crp->crp_olen = (int)sw->sw_size;
1105 			break;
1106 
1107 		default:
1108 			/* Unknown/unsupported algorithm */
1109 			crp->crp_etype = EINVAL;
1110 			goto done;
1111 		}
1112 	}
1113 
1114 done:
1115 	crypto_done(crp);
1116 	return 0;
1117 }
1118 
1119 /*
1120  * Initialize the driver, called from the kernel main().
1121  */
1122 /*static*/
1123 void
1124 swcr_init(void)
1125 {
1126 	swcr_id = crypto_get_driverid(CRYPTOCAP_F_SOFTWARE);
1127 	if (swcr_id < 0) {
1128 		/* This should never happen */
1129 		panic("Software crypto device cannot initialize!");
1130 	}
1131 
1132 	crypto_register(swcr_id, CRYPTO_DES_CBC,
1133 	    0, 0, swcr_newsession, swcr_freesession, swcr_process, NULL);
1134 #define	REGISTER(alg) \
1135 	crypto_register(swcr_id, alg, 0, 0, NULL, NULL, NULL, NULL)
1136 
1137 	REGISTER(CRYPTO_3DES_CBC);
1138 	REGISTER(CRYPTO_BLF_CBC);
1139 	REGISTER(CRYPTO_CAST_CBC);
1140 	REGISTER(CRYPTO_SKIPJACK_CBC);
1141 	REGISTER(CRYPTO_NULL_CBC);
1142 	REGISTER(CRYPTO_MD5_HMAC);
1143 	REGISTER(CRYPTO_SHA1_HMAC);
1144 	REGISTER(CRYPTO_SHA2_HMAC);
1145 	REGISTER(CRYPTO_RIPEMD160_HMAC);
1146 	REGISTER(CRYPTO_NULL_HMAC);
1147 	REGISTER(CRYPTO_MD5_KPDK);
1148 	REGISTER(CRYPTO_SHA1_KPDK);
1149 	REGISTER(CRYPTO_MD5);
1150 	REGISTER(CRYPTO_SHA1);
1151 	REGISTER(CRYPTO_RIJNDAEL128_CBC);
1152 	REGISTER(CRYPTO_DEFLATE_COMP);
1153 #undef REGISTER
1154 }
1155 
1156 #ifdef __FreeBSD__
1157 SYSINIT(cryptosoft_init, SI_SUB_PSEUDO, SI_ORDER_ANY, swcr_init, NULL)
1158 #endif
1159