summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.gitignore1
-rw-r--r--examples/Makefile4
-rw-r--r--examples/ncr-user.c930
-rw-r--r--examples/ncr.c11
-rw-r--r--examples/pk.c7
-rw-r--r--ncr-data.c188
-rw-r--r--ncr-key-wrap.c44
-rw-r--r--ncr-key.c36
-rw-r--r--ncr-sessions.c89
-rw-r--r--ncr.c2
-rw-r--r--ncr.h16
-rw-r--r--ncr_int.h19
12 files changed, 105 insertions, 1242 deletions
diff --git a/.gitignore b/.gitignore
index 6728db5..4379d92 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,7 +10,6 @@ modules.order
examples/cipher
examples/hmac
examples/ncr
-examples/ncr-user
examples/pk
examples/speed
releases
diff --git a/examples/Makefile b/examples/Makefile
index a2849d3..c65297f 100644
--- a/examples/Makefile
+++ b/examples/Makefile
@@ -17,15 +17,11 @@ hmac: hmac.c
ncr: ncr.c
$(CC) $(CFLAGS) $< -o $@
-ncr-user: ncr-user.c
- $(CC) $(CFLAGS) $< -o $@
-
pk: pk.c
$(CC) $(CFLAGS) $< -o $@ -L/usr/local/lib -lgnutls
check: $(progs)
./ncr
- ./ncr-user
./pk
./cipher
./hmac
diff --git a/examples/ncr-user.c b/examples/ncr-user.c
deleted file mode 100644
index 613f81c..0000000
--- a/examples/ncr-user.c
+++ /dev/null
@@ -1,930 +0,0 @@
-/*
- * Demo on how to use /dev/crypto device for HMAC.
- *
- * Placed under public domain.
- *
- */
-#include <stdio.h>
-#include <string.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <time.h>
-#include <sys/ioctl.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include "../ncr.h"
-#include <stdlib.h>
-
-#define DATA_SIZE 4096
-
-static void randomize_data(uint8_t * data, size_t data_size)
-{
-int i;
-
- srand(time(0)*getpid());
- for (i=0;i<data_size;i++) {
- data[i] = rand() & 0xff;
- }
-}
-
-#define KEY_DATA_SIZE 16
-#define WRAPPED_KEY_DATA_SIZE 32
-static int
-test_ncr_key(int cfd)
-{
- struct ncr_data_init_user_st dinit;
- struct ncr_key_generate_st kgen;
- ncr_key_t key;
- struct ncr_key_data_st keydata;
- struct ncr_data_st kdata;
- uint8_t data[KEY_DATA_SIZE];
- uint8_t data_bak[KEY_DATA_SIZE];
- size_t data_size = KEY_DATA_SIZE;
- size_t data_size_bak = sizeof(data_bak);
-
- fprintf(stdout, "Tests on Keys:\n");
-
- /* test 1: generate a key in userspace import it
- * to kernel via data and export it.
- */
-
- fprintf(stdout, "\tKey generation...\n");
-
- randomize_data(data, sizeof(data));
- memcpy(data_bak, data, sizeof(data));
-
- dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
- dinit.data = data;
- dinit.data_size_ptr = &data_size;
-
- if (ioctl(cfd, NCRIO_DATA_INIT_USER, &dinit)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_DATA_INIT)");
- return 1;
- }
-
- /* convert it to key */
- if (ioctl(cfd, NCRIO_KEY_INIT, &key)) {
- perror("ioctl(NCRIO_KEY_INIT)");
- return 1;
- }
-
- keydata.key_id[0] = 'a';
- keydata.key_id[2] = 'b';
- keydata.key_id_size = 2;
- keydata.type = NCR_KEY_TYPE_SECRET;
- keydata.algorithm = NCR_ALG_AES_CBC;
- keydata.flags = NCR_KEY_FLAG_EXPORTABLE;
-
- keydata.key = key;
- keydata.data = dinit.desc;
-
- if (ioctl(cfd, NCRIO_KEY_IMPORT, &keydata)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
-
- /* now try to read it */
- fprintf(stdout, "\tKey export...\n");
- if (ioctl(cfd, NCRIO_DATA_DEINIT, &dinit.desc)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_DATA_DEINIT)");
- return 1;
- }
-
- data_size_bak = sizeof(data_bak);
- dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
- dinit.data = data_bak;
- dinit.data_size_ptr = &data_size_bak;
-
- if (ioctl(cfd, NCRIO_DATA_INIT_USER, &dinit)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_DATA_INIT)");
- return 1;
- }
-
- memset(&keydata, 0, sizeof(keydata));
- keydata.key = key;
- keydata.data = dinit.desc;
-
- if (ioctl(cfd, NCRIO_KEY_EXPORT, &keydata)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
-
- if (memcmp(data, data_bak, sizeof(data))!=0) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- fprintf(stderr, "data returned but differ (%d, %d)!\n", (int)kdata.data_size, (int)sizeof(data));
- return 1;
- }
-
- if (ioctl(cfd, NCRIO_KEY_DEINIT, &key)) {
- perror("ioctl(NCRIO_KEY_DEINIT)");
- return 1;
- }
-
- /* finished, we keep data for next test */
-
- /* test 2: generate a key in kernel space and
- * export it.
- */
-
- fprintf(stdout, "\tKey import...\n");
- /* convert it to key */
- if (ioctl(cfd, NCRIO_KEY_INIT, &key)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_INIT)");
- return 1;
- }
-
- kgen.desc = key;
- kgen.params.algorithm = NCR_ALG_AES_CBC;
- kgen.params.keyflags = NCR_KEY_FLAG_EXPORTABLE;
- kgen.params.params.secret.bits = 128; /* 16 bytes */
-
- if (ioctl(cfd, NCRIO_KEY_GENERATE, &kgen)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
-
- /* now read data */
- memset(data_bak, 0, sizeof(data_bak));
-
- memset(&keydata, 0, sizeof(keydata));
- keydata.key = key;
- keydata.data = dinit.desc;
-
- if (ioctl(cfd, NCRIO_KEY_EXPORT, &keydata)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
-
-#if 0
- fprintf(stderr, "Generated key: %.2x.%.2x.%.2x.%.2x.%.2x.%.2x.%.2x.%.2x."
- "%.2x.%.2x.%.2x.%.2x.%.2x.%.2x.%.2x.%.2x\n", data_bak[0], data_bak[1],
- data_bak[2], data_bak[3], data_bak[4], data_bak[5], data_bak[6], data_bak[7], data_bak[8],
- data_bak[9], data_bak[10], data_bak[11], data_bak[12], data_bak[13], data_bak[14],
- data_bak[15]);
-#endif
-
- if (ioctl(cfd, NCRIO_KEY_DEINIT, &key)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_DEINIT)");
- return 1;
- }
-
- /* test 3: generate an unexportable key in kernel space and
- * try to export it.
- */
- fprintf(stdout, "\tKey protection of non-exportable keys...\n");
- if (ioctl(cfd, NCRIO_KEY_INIT, &key)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_INIT)");
- return 1;
- }
-
- kgen.desc = key;
- kgen.params.algorithm = NCR_ALG_AES_CBC;
- kgen.params.keyflags = 0;
- kgen.params.params.secret.bits = 128; /* 16 bytes */
-
- if (ioctl(cfd, NCRIO_KEY_GENERATE, &kgen)) {
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
-
- memset(&keydata, 0, sizeof(keydata));
- keydata.key = key;
- keydata.data = dinit.desc;
-
- /* try to get the output data - should fail */
- memset(data_bak, 0, sizeof(data_bak));
-
- if (ioctl(cfd, NCRIO_KEY_EXPORT, &keydata)==0) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- fprintf(stderr, "Data were exported, but shouldn't be!\n");
- return 1;
- }
-
- if (ioctl(cfd, NCRIO_KEY_DEINIT, &key)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_DEINIT)");
- return 1;
- }
-
- return 0;
-}
-
-
-
-/* Key wrapping */
-static int
-test_ncr_wrap_key(int cfd)
-{
- int i;
- struct ncr_data_init_user_st dinit;
- ncr_key_t key, key2;
- struct ncr_key_data_st keydata;
- struct ncr_key_wrap_st kwrap;
- uint8_t data[WRAPPED_KEY_DATA_SIZE];
- size_t data_size = sizeof(data);
-
-
- fprintf(stdout, "Tests on Keys:\n");
-
- /* test 1: generate a key in userspace import it
- * to kernel via data and export it.
- */
-
- fprintf(stdout, "\tKey Wrap test...\n");
-
- memcpy(data, "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F", 16);
- data_size = 16;
-
- dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
- dinit.data = data;
- dinit.data_size_ptr = &data_size;
-
- if (ioctl(cfd, NCRIO_DATA_INIT_USER, &dinit)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_DATA_INIT)");
- return 1;
- }
-
- /* convert it to key */
- if (ioctl(cfd, NCRIO_KEY_INIT, &key)) {
- perror("ioctl(NCRIO_KEY_INIT)");
- return 1;
- }
-
- keydata.key_id[0] = 'a';
- keydata.key_id[2] = 'b';
- keydata.key_id_size = 2;
- keydata.type = NCR_KEY_TYPE_SECRET;
- keydata.algorithm = NCR_ALG_AES_CBC;
- keydata.flags = NCR_KEY_FLAG_EXPORTABLE|NCR_KEY_FLAG_WRAPPABLE;
-
- keydata.key = key;
- keydata.data = dinit.desc;
-
- if (ioctl(cfd, NCRIO_KEY_IMPORT, &keydata)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
-
-#define DKEY "\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xAA\xBB\xCC\xDD\xEE\xFF"
- /* now key data */
- memcpy(data, DKEY, 16);
- data_size = 16;
-
- /* convert it to key */
- if (ioctl(cfd, NCRIO_KEY_INIT, &key2)) {
- perror("ioctl(NCRIO_KEY_INIT)");
- return 1;
- }
-
- keydata.key_id[0] = 'b';
- keydata.key_id[2] = 'a';
- keydata.key_id_size = 2;
- keydata.type = NCR_KEY_TYPE_SECRET;
- keydata.algorithm = NCR_ALG_AES_CBC;
- keydata.flags = NCR_KEY_FLAG_EXPORTABLE|NCR_KEY_FLAG_WRAPPABLE;
-
- keydata.key = key2;
- keydata.data = dinit.desc;
-
- if (ioctl(cfd, NCRIO_KEY_IMPORT, &keydata)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
-
- /* now try wrapping key2 using key */
- memset(&kwrap, 0, sizeof(kwrap));
- kwrap.algorithm = NCR_WALG_AES_RFC3394;
- kwrap.keytowrap = key2;
- kwrap.key.key = key;
- kwrap.data = dinit.desc;
-
- /* increase data_size to be able to write */
- data_size = sizeof(data);
-
- if (ioctl(cfd, NCRIO_KEY_WRAP, &kwrap)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_WRAP)");
- return 1;
- }
-
- if (data_size != 24 || memcmp(data,
- "\x1F\xA6\x8B\x0A\x81\x12\xB4\x47\xAE\xF3\x4B\xD8\xFB\x5A\x7B\x82\x9D\x3E\x86\x23\x71\xD2\xCF\xE5", 24) != 0) {
- fprintf(stderr, "Wrapped data do not match.\n");
-
- fprintf(stderr, "Data[%d]: ",(int) data_size);
- for(i=0;i<data_size;i++)
- fprintf(stderr, "%.2x:", data[i]);
- fprintf(stderr, "\n");
- return 1;
- }
-
-
-
-
- /* test unwrapping */
- fprintf(stdout, "\tKey Unwrap test...\n");
-
- /* reset key2 */
- if (ioctl(cfd, NCRIO_KEY_DEINIT, &key2)) {
- perror("ioctl(NCRIO_KEY_DEINIT)");
- return 1;
- }
-
- if (ioctl(cfd, NCRIO_KEY_INIT, &key2)) {
- perror("ioctl(NCRIO_KEY_INIT)");
- return 1;
- }
-
- memset(&kwrap, 0, sizeof(kwrap));
- kwrap.algorithm = NCR_WALG_AES_RFC3394;
- kwrap.keytowrap = key2;
- kwrap.key.key = key;
- kwrap.data = dinit.desc;
-
- if (ioctl(cfd, NCRIO_KEY_UNWRAP, &kwrap)) {
- perror("ioctl(NCRIO_KEY_UNWRAP)");
- return 1;
- }
-
- return 0;
-
-}
-
-static int
-test_ncr_store_wrap_key(int cfd)
-{
- int i;
- struct ncr_data_init_user_st dinit;
- ncr_key_t key2;
- struct ncr_key_data_st keydata;
- struct ncr_key_storage_wrap_st kwrap;
- uint8_t data[DATA_SIZE];
- size_t data_size = sizeof(data);
- int dd;
-
- fprintf(stdout, "Tests on Key storage:\n");
-
- /* test 1: generate a key in userspace import it
- * to kernel via data and export it.
- */
-
- fprintf(stdout, "\tKey Storage wrap test...\n");
-
- memset(&dinit, 0, sizeof(dinit));
-
- dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
- dinit.data = data;
- dinit.data_size_ptr = &data_size;
-
- if (ioctl(cfd, NCRIO_DATA_INIT_USER, &dinit)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_DATA_INIT)");
- return 1;
- }
-
- dd = dinit.desc;
-
-#define DKEY "\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xAA\xBB\xCC\xDD\xEE\xFF"
- /* now key data */
- memcpy(data, DKEY, 16);
- data_size = 16;
-
- /* convert it to key */
- if (ioctl(cfd, NCRIO_KEY_INIT, &key2)) {
- perror("ioctl(NCRIO_KEY_INIT)");
- return 1;
- }
-
- keydata.key_id[0] = 'b';
- keydata.key_id[2] = 'a';
- keydata.key_id_size = 2;
- keydata.type = NCR_KEY_TYPE_SECRET;
- keydata.algorithm = NCR_ALG_AES_CBC;
- keydata.flags = NCR_KEY_FLAG_EXPORTABLE|NCR_KEY_FLAG_WRAPPABLE;
-
- keydata.key = key2;
- keydata.data = dd;
-
- if (ioctl(cfd, NCRIO_KEY_IMPORT, &keydata)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
-
- data_size = sizeof(data);
-
- /* now try wrapping key2 using key */
- memset(&kwrap, 0, sizeof(kwrap));
- kwrap.keytowrap = key2;
- kwrap.data = dd;
-
- if (ioctl(cfd, NCRIO_KEY_STORAGE_WRAP, &kwrap)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_STORAGE_WRAP)");
- return 1;
- }
-
- /* test unwrapping */
- fprintf(stdout, "\tKey Storage Unwrap test...\n");
-
- /* reset key2 */
- if (ioctl(cfd, NCRIO_KEY_DEINIT, &key2)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_DEINIT)");
- return 1;
- }
-
- if (ioctl(cfd, NCRIO_KEY_INIT, &key2)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_INIT)");
- return 1;
- }
-
- memset(&kwrap, 0, sizeof(kwrap));
- kwrap.keytowrap = key2;
- kwrap.data = dd;
-
- if (ioctl(cfd, NCRIO_KEY_STORAGE_UNWRAP, &kwrap)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_STORAGE_UNWRAP)");
- return 1;
- }
-
- data_size = sizeof(data);
-
- /* now export the unwrapped */
- memset(&keydata, 0, sizeof(keydata));
- keydata.key = key2;
- keydata.data = dd;
-
- if (ioctl(cfd, NCRIO_KEY_EXPORT, &keydata)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
-
- if (data_size != 16 || memcmp(data, DKEY, 16) != 0) {
- fprintf(stderr, "Unwrapped data do not match.\n");
- fprintf(stderr, "Data[%d]: ", (int)data_size);
- for(i=0;i<data_size;i++)
- fprintf(stderr, "%.2x:", data[i]);
- fprintf(stderr, "\n");
- return 1;
- }
-
- return 0;
-
-}
-
-struct aes_vectors_st {
- const uint8_t* key;
- const uint8_t* plaintext;
- const uint8_t* ciphertext;
-} aes_vectors[] = {
- {
- .key = (uint8_t*)"\xc0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
- .plaintext = (uint8_t*)"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
- .ciphertext = (uint8_t*)"\x4b\xc3\xf8\x83\x45\x0c\x11\x3c\x64\xca\x42\xe1\x11\x2a\x9e\x87",
- },
- {
- .key = (uint8_t*)"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
- .plaintext = (uint8_t*)"\xf3\x44\x81\xec\x3c\xc6\x27\xba\xcd\x5d\xc3\xfb\x08\xf2\x73\xe6",
- .ciphertext = (uint8_t*)"\x03\x36\x76\x3e\x96\x6d\x92\x59\x5a\x56\x7c\xc9\xce\x53\x7f\x5e",
- },
- {
- .key = (uint8_t*)"\x10\xa5\x88\x69\xd7\x4b\xe5\xa3\x74\xcf\x86\x7c\xfb\x47\x38\x59",
- .plaintext = (uint8_t*)"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
- .ciphertext = (uint8_t*)"\x6d\x25\x1e\x69\x44\xb0\x51\xe0\x4e\xaa\x6f\xb4\xdb\xf7\x84\x65",
- },
- {
- .key = (uint8_t*)"\xca\xea\x65\xcd\xbb\x75\xe9\x16\x9e\xcd\x22\xeb\xe6\xe5\x46\x75",
- .plaintext = (uint8_t*)"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
- .ciphertext = (uint8_t*)"\x6e\x29\x20\x11\x90\x15\x2d\xf4\xee\x05\x81\x39\xde\xf6\x10\xbb",
- },
- {
- .key = (uint8_t*)"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe",
- .plaintext = (uint8_t*)"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
- .ciphertext = (uint8_t*)"\x9b\xa4\xa9\x14\x3f\x4e\x5d\x40\x48\x52\x1c\x4f\x88\x77\xd8\x8e",
- },
-};
-
-/* AES cipher */
-static int
-test_ncr_aes(int cfd)
-{
- struct ncr_data_init_user_st dinit;
- ncr_key_t key;
- struct ncr_key_data_st keydata;
- ncr_data_t dd, dd2;
- uint8_t data[KEY_DATA_SIZE];
- size_t data_size = sizeof(data);
- uint8_t data2[KEY_DATA_SIZE];
- size_t data_size2 = sizeof(data2);
- int i, j;
- struct ncr_session_once_op_st nop;
-
- dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
- dinit.data = data;
- dinit.data_size_ptr = &data_size;
-
- if (ioctl(cfd, NCRIO_DATA_INIT_USER, &dinit)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_DATA_INIT)");
- return 1;
- }
-
- dd = dinit.desc;
-
- dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
- dinit.data = data2;
- dinit.data_size_ptr = &data_size2;
-
- if (ioctl(cfd, NCRIO_DATA_INIT_USER, &dinit)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_DATA_INIT)");
- return 1;
- }
-
- dd2 = dinit.desc;
-
- /* convert it to key */
- if (ioctl(cfd, NCRIO_KEY_INIT, &key)) {
- perror("ioctl(NCRIO_KEY_INIT)");
- return 1;
- }
-
- keydata.key_id[0] = 'a';
- keydata.key_id[2] = 'b';
- keydata.key_id_size = 2;
- keydata.type = NCR_KEY_TYPE_SECRET;
- keydata.algorithm = NCR_ALG_AES_CBC;
- keydata.flags = NCR_KEY_FLAG_EXPORTABLE;
-
-
- fprintf(stdout, "Tests on AES Encryption\n");
- for (i=0;i<sizeof(aes_vectors)/sizeof(aes_vectors[0]);i++) {
-
- /* import key */
- memcpy(data, (void*)aes_vectors[i].key, 16);
- data_size = 16;
-
- keydata.key = key;
- keydata.data = dd;
- if (ioctl(cfd, NCRIO_KEY_IMPORT, &keydata)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
- /* import data */
-
- memcpy(data, (void*)aes_vectors[i].plaintext, 16);
- data_size = 16;
-
- /* encrypt */
- memset(&nop, 0, sizeof(nop));
- nop.init.algorithm = NCR_ALG_AES_ECB;
- nop.init.params.key = key;
- nop.init.op = NCR_OP_ENCRYPT;
- nop.op.data.cipher.plaintext = dd;
- nop.op.data.cipher.ciphertext = dd2;
-
- if (ioctl(cfd, NCRIO_SESSION_ONCE, &nop)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_SESSION_ONCE)");
- return 1;
- }
-
- if (data_size2 != 16 || memcmp(data2, aes_vectors[i].ciphertext, 16) != 0) {
- fprintf(stderr, "AES test vector %d failed!\n", i);
-
- fprintf(stderr, "Cipher[%d]: ", (int)data_size2);
- for(j=0;j<data_size2;j++)
- fprintf(stderr, "%.2x:", (int)data2[j]);
- fprintf(stderr, "\n");
-
- fprintf(stderr, "Expected[%d]: ", 16);
- for(j=0;j<16;j++)
- fprintf(stderr, "%.2x:", (int)aes_vectors[i].ciphertext[j]);
- fprintf(stderr, "\n");
- return 1;
- }
- }
-
- fprintf(stdout, "Tests on AES Decryption\n");
- for (i=0;i<sizeof(aes_vectors)/sizeof(aes_vectors[0]);i++) {
-
- /* import key */
- memcpy(data, (void*)aes_vectors[i].key, 16);
- data_size = 16;
-
- keydata.key = key;
- keydata.data = dd;
- if (ioctl(cfd, NCRIO_KEY_IMPORT, &keydata)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
-
- /* import ciphertext */
-
- memcpy(data, (void*)aes_vectors[i].ciphertext, 16);
- data_size = 16;
- data_size2 = sizeof(data2);
-
- /* decrypt */
- memset(&nop, 0, sizeof(nop));
- nop.init.algorithm = NCR_ALG_AES_ECB;
- nop.init.params.key = key;
- nop.init.op = NCR_OP_DECRYPT;
- nop.op.data.cipher.ciphertext = dd;
- nop.op.data.cipher.plaintext = dd2;
-
- if (ioctl(cfd, NCRIO_SESSION_ONCE, &nop)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_SESSION_ONCE)");
- return 1;
- }
-
- if (data_size2 != 16 || memcmp(data2, aes_vectors[i].plaintext, 16) != 0) {
- fprintf(stderr, "AES test vector %d failed!\n", i);
-
- fprintf(stderr, "Plain[%d]: ", (int)data_size2);
- for(j=0;j<data_size2;j++)
- fprintf(stderr, "%.2x:", (int)data2[j]);
- fprintf(stderr, "\n");
-
- fprintf(stderr, "Expected[%d]: ", 16);
- for(j=0;j<16;j++)
- fprintf(stderr, "%.2x:", (int)aes_vectors[i].plaintext[j]);
- fprintf(stderr, "\n");
- return 1;
- }
- }
-
-
- fprintf(stdout, "\n");
-
- return 0;
-
-}
-
-struct hash_vectors_st {
- const char* name;
- ncr_algorithm_t algorithm;
- const uint8_t* key; /* if hmac */
- int key_size;
- const uint8_t* plaintext;
- int plaintext_size;
- const uint8_t* output;
- int output_size;
- ncr_crypto_op_t op;
-} hash_vectors[] = {
- {
- .name = "SHA1",
- .algorithm = NCR_ALG_SHA1,
- .key = NULL,
- .plaintext = (uint8_t*)"what do ya want for nothing?",
- .plaintext_size = sizeof("what do ya want for nothing?")-1,
- .output = (uint8_t*)"\x8f\x82\x03\x94\xf9\x53\x35\x18\x20\x45\xda\x24\xf3\x4d\xe5\x2b\xf8\xbc\x34\x32",
- .output_size = 20,
- .op = NCR_OP_DIGEST,
- },
- {
- .name = "HMAC-MD5",
- .algorithm = NCR_ALG_HMAC_MD5,
- .key = (uint8_t*)"Jefe",
- .key_size = 4,
- .plaintext = (uint8_t*)"what do ya want for nothing?",
- .plaintext_size = sizeof("what do ya want for nothing?")-1,
- .output = (uint8_t*)"\x75\x0c\x78\x3e\x6a\xb0\xb5\x03\xea\xa8\x6e\x31\x0a\x5d\xb7\x38",
- .output_size = 16,
- .op = NCR_OP_SIGN,
- },
- /* from rfc4231 */
- {
- .name = "HMAC-SHA224",
- .algorithm = NCR_ALG_HMAC_SHA2_224,
- .key = (uint8_t*)"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b",
- .key_size = 20,
- .plaintext = (uint8_t*)"Hi There",
- .plaintext_size = sizeof("Hi There")-1,
- .output = (uint8_t*)"\x89\x6f\xb1\x12\x8a\xbb\xdf\x19\x68\x32\x10\x7c\xd4\x9d\xf3\x3f\x47\xb4\xb1\x16\x99\x12\xba\x4f\x53\x68\x4b\x22",
- .output_size = 28,
- .op = NCR_OP_SIGN,
- },
- {
- .name = "HMAC-SHA256",
- .algorithm = NCR_ALG_HMAC_SHA2_256,
- .key = (uint8_t*)"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b",
- .key_size = 20,
- .plaintext = (uint8_t*)"Hi There",
- .plaintext_size = sizeof("Hi There")-1,
- .output = (uint8_t*)"\xb0\x34\x4c\x61\xd8\xdb\x38\x53\x5c\xa8\xaf\xce\xaf\x0b\xf1\x2b\x88\x1d\xc2\x00\xc9\x83\x3d\xa7\x26\xe9\x37\x6c\x2e\x32\xcf\xf7",
- .output_size = 32,
- .op = NCR_OP_SIGN,
- },
- {
- .name = "HMAC-SHA384",
- .algorithm = NCR_ALG_HMAC_SHA2_384,
- .key = (uint8_t*)"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b",
- .key_size = 20,
- .plaintext = (uint8_t*)"Hi There",
- .plaintext_size = sizeof("Hi There")-1,
- .output = (uint8_t*)"\xaf\xd0\x39\x44\xd8\x48\x95\x62\x6b\x08\x25\xf4\xab\x46\x90\x7f\x15\xf9\xda\xdb\xe4\x10\x1e\xc6\x82\xaa\x03\x4c\x7c\xeb\xc5\x9c\xfa\xea\x9e\xa9\x07\x6e\xde\x7f\x4a\xf1\x52\xe8\xb2\xfa\x9c\xb6",
- .output_size = 48,
- .op = NCR_OP_SIGN,
- },
- {
- .name = "HMAC-SHA512",
- .algorithm = NCR_ALG_HMAC_SHA2_512,
- .key = (uint8_t*)"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b",
- .key_size = 20,
- .plaintext = (uint8_t*)"Hi There",
- .plaintext_size = sizeof("Hi There")-1,
- .output = (uint8_t*)"\x87\xaa\x7c\xde\xa5\xef\x61\x9d\x4f\xf0\xb4\x24\x1a\x1d\x6c\xb0\x23\x79\xf4\xe2\xce\x4e\xc2\x78\x7a\xd0\xb3\x05\x45\xe1\x7c\xde\xda\xa8\x33\xb7\xd6\xb8\xa7\x02\x03\x8b\x27\x4e\xae\xa3\xf4\xe4\xbe\x9d\x91\x4e\xeb\x61\xf1\x70\x2e\x69\x6c\x20\x3a\x12\x68\x54",
- .output_size = 64,
- .op = NCR_OP_SIGN,
- },
-};
-
-#define HASH_DATA_SIZE 64
-
-/* SHA1 and other hashes */
-static int
-test_ncr_hash(int cfd)
-{
- struct ncr_data_init_user_st dinit;
- ncr_key_t key;
- struct ncr_key_data_st keydata;
- ncr_data_t dd, dd2;
- uint8_t data[HASH_DATA_SIZE];
- size_t data_size = sizeof(data);
- uint8_t data2[HASH_DATA_SIZE];
- size_t data_size2 = sizeof(data2);
- int i, j;
- struct ncr_session_once_op_st nop;
-
- dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
- dinit.data = data;
- dinit.data_size_ptr = &data_size;
-
- if (ioctl(cfd, NCRIO_DATA_INIT_USER, &dinit)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_DATA_INIT)");
- return 1;
- }
-
- dd = dinit.desc;
-
- dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
- dinit.data = data2;
- dinit.data_size_ptr = &data_size2;
-
- if (ioctl(cfd, NCRIO_DATA_INIT_USER, &dinit)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_DATA_INIT)");
- return 1;
- }
-
- dd2 = dinit.desc;
-
- /* convert it to key */
- if (ioctl(cfd, NCRIO_KEY_INIT, &key)) {
- perror("ioctl(NCRIO_KEY_INIT)");
- return 1;
- }
-
- keydata.key_id[0] = 'a';
- keydata.key_id[2] = 'b';
- keydata.key_id_size = 2;
- keydata.type = NCR_KEY_TYPE_SECRET;
- keydata.algorithm = NCR_ALG_AES_CBC;
- keydata.flags = NCR_KEY_FLAG_EXPORTABLE;
-
-
- fprintf(stdout, "Tests on Hashes\n");
- for (i=0;i<sizeof(hash_vectors)/sizeof(hash_vectors[0]);i++) {
-
- fprintf(stdout, "\t%s:\n", hash_vectors[i].name);
- /* import key */
- if (hash_vectors[i].key != NULL) {
- memcpy(data, (void*)hash_vectors[i].key, hash_vectors[i].key_size);
- data_size = hash_vectors[i].key_size;
-
- keydata.key = key;
- keydata.data = dd;
- if (ioctl(cfd, NCRIO_KEY_IMPORT, &keydata)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_KEY_IMPORT)");
- return 1;
- }
- }
- /* import data */
-
- memcpy(data, (void*)hash_vectors[i].plaintext, hash_vectors[i].plaintext_size);
- data_size = hash_vectors[i].plaintext_size;
-
- data_size2 = sizeof(data2);
-
- /* encrypt */
- memset(&nop, 0, sizeof(nop));
- nop.init.algorithm = hash_vectors[i].algorithm;
- if (hash_vectors[i].key != NULL)
- nop.init.params.key = key;
- nop.init.op = hash_vectors[i].op;
- nop.op.data.sign.text = dd;
- nop.op.data.sign.output = dd2;
-
- if (ioctl(cfd, NCRIO_SESSION_ONCE, &nop)) {
- fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- perror("ioctl(NCRIO_SESSION_ONCE)");
- return 1;
- }
-
- /* verify */
- if (data_size2 != hash_vectors[i].output_size ||
- memcmp(data2, hash_vectors[i].output, hash_vectors[i].output_size) != 0) {
- fprintf(stderr, "HASH test vector %d failed!\n", i);
-
- fprintf(stderr, "Output[%d]: ", (int)data_size2);
- for(j=0;j<data_size2;j++)
- fprintf(stderr, "%.2x:", (int)data2[j]);
- fprintf(stderr, "\n");
-
- fprintf(stderr, "Expected[%d]: ", hash_vectors[i].output_size);
- for(j=0;j<hash_vectors[i].output_size;j++)
- fprintf(stderr, "%.2x:", (int)hash_vectors[i].output[j]);
- fprintf(stderr, "\n");
- return 1;
- }
- }
-
- fprintf(stdout, "\n");
-
- return 0;
-
-}
-
-
-int
-main()
-{
- int fd = -1;
-
- /* Open the crypto device */
- fd = open("/dev/crypto", O_RDWR, 0);
- if (fd < 0) {
- perror("open(/dev/crypto)");
- return 1;
- }
-
- /* Close the original descriptor */
- if (close(fd)) {
- perror("close(fd)");
- return 1;
- }
-
- /* actually test if the initial close
- * will really delete all used lists */
-
- fd = open("/dev/crypto", O_RDWR, 0);
- if (fd < 0) {
- perror("open(/dev/crypto)");
- return 1;
- }
- if (test_ncr_key(fd))
- return 1;
-
- if (test_ncr_aes(fd))
- return 1;
-
- if (test_ncr_hash(fd))
- return 1;
-
- if (test_ncr_wrap_key(fd))
- return 1;
-
- if (test_ncr_store_wrap_key(fd))
- return 1;
-
- /* Close the original descriptor */
- if (close(fd)) {
- perror("close(fd)");
- return 1;
- }
-
- return 0;
-}
diff --git a/examples/ncr.c b/examples/ncr.c
index de8288d..d5d3e20 100644
--- a/examples/ncr.c
+++ b/examples/ncr.c
@@ -55,6 +55,7 @@ test_ncr_key(int cfd)
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
dinit.initial_data = data;
dinit.initial_data_size = sizeof(data);
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -96,6 +97,7 @@ test_ncr_key(int cfd)
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
dinit.initial_data = NULL;
dinit.initial_data_size = 0;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -127,7 +129,7 @@ test_ncr_key(int cfd)
if (memcmp(data, data_bak, sizeof(data))!=0) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
- fprintf(stderr, "data returned but differ (%d, %d)!\n", (int)kdata.data_size, (int)sizeof(data));
+ fprintf(stderr, "data returned but differ (%d, %d)!\n", (int)kdata.data_size, sizeof(data));
return 1;
}
@@ -268,6 +270,7 @@ static int test_ncr_data(int cfd)
init.flags = NCR_DATA_FLAG_EXPORTABLE;
init.initial_data = data;
init.initial_data_size = sizeof(data);
+ init.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &init)) {
perror("ioctl(NCRIO_DATA_INIT)");
@@ -338,6 +341,7 @@ static int test_ncr_data(int cfd)
init.flags = 0;
init.initial_data = data;
init.initial_data_size = sizeof(data);
+ init.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &init)) {
perror("ioctl(NCRIO_DATA_INIT)");
@@ -359,6 +363,7 @@ static int test_ncr_data(int cfd)
init.flags = 0;
init.initial_data = data;
init.initial_data_size = sizeof(data);
+ init.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &init)) {
//fprintf(stderr, "Reached maximum limit at: %d data items\n", i);
@@ -396,6 +401,7 @@ test_ncr_wrap_key(int cfd)
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
dinit.initial_data = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
dinit.initial_data_size = 16;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -579,6 +585,7 @@ test_ncr_store_wrap_key(int cfd)
memset(&dinit, 0, sizeof(dinit));
dinit.max_object_size = DATA_SIZE;
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -739,6 +746,7 @@ test_ncr_aes(int cfd)
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
dinit.initial_data = NULL;
dinit.initial_data_size = 0;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -1024,6 +1032,7 @@ test_ncr_hash(int cfd)
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
dinit.initial_data = NULL;
dinit.initial_data_size = 0;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
diff --git a/examples/pk.c b/examples/pk.c
index 1f3d3c1..edae150 100644
--- a/examples/pk.c
+++ b/examples/pk.c
@@ -339,6 +339,7 @@ static int rsa_key_encrypt(int cfd, ncr_key_t privkey, ncr_key_t pubkey, int oae
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
dinit.initial_data = data;
dinit.initial_data_size = RSA_ENCRYPT_SIZE;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -351,6 +352,7 @@ static int rsa_key_encrypt(int cfd, ncr_key_t privkey, ncr_key_t pubkey, int oae
memset(&dinit, 0, sizeof(dinit));
dinit.max_object_size = DATA_SIZE;
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -437,6 +439,7 @@ static int rsa_key_sign_verify(int cfd, ncr_key_t privkey, ncr_key_t pubkey, int
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
dinit.initial_data = data;
dinit.initial_data_size = sizeof(data);
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -449,6 +452,7 @@ static int rsa_key_sign_verify(int cfd, ncr_key_t privkey, ncr_key_t pubkey, int
memset(&dinit, 0, sizeof(dinit));
dinit.max_object_size = DATA_SIZE;
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -529,6 +533,7 @@ static int dsa_key_sign_verify(int cfd, ncr_key_t privkey, ncr_key_t pubkey)
memset(&dinit, 0, sizeof(dinit));
dinit.max_object_size = DATA_SIZE;
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -621,6 +626,7 @@ static int test_ncr_rsa(int cfd)
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
dinit.initial_data = NULL;
dinit.initial_data_size = 0;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
@@ -763,6 +769,7 @@ static int test_ncr_dsa(int cfd)
dinit.flags = NCR_DATA_FLAG_EXPORTABLE;
dinit.initial_data = NULL;
dinit.initial_data_size = 0;
+ dinit.type = NCR_DATA_KERNEL;
if (ioctl(cfd, NCRIO_DATA_INIT, &dinit)) {
fprintf(stderr, "Error: %s:%d\n", __func__, __LINE__);
diff --git a/ncr-data.c b/ncr-data.c
index 73ee737..d0ff5b9 100644
--- a/ncr-data.c
+++ b/ncr-data.c
@@ -102,7 +102,7 @@ void _ncr_data_item_put( struct data_item_st* item)
if (atomic_dec_and_test(&item->refcnt)) {
ncr_limits_remove(item->uid, item->pid, LIMIT_TYPE_DATA);
if (item->type == NCR_DATA_KERNEL)
- kfree(item->data.kernel.data);
+ kfree(item->data.kernel);
else if (item->type == NCR_DATA_USER)
ncr_data_item_put_sg(item); /* just in case */
kfree(item);
@@ -115,25 +115,16 @@ int ncr_data_item_get_sg( struct data_item_st* item, struct scatterlist** sg,
if (item->type == NCR_DATA_KERNEL) {
item->flags = data_flags;
- sg_init_one(item->_sg, item->data.kernel.data, item->data.kernel.max_data_size);
+ sg_init_one(item->_sg, item->data.kernel, item->max_data_size);
- if (data_size) *data_size = item->data.kernel.data_size;
- if (max_data_size) *max_data_size = item->data.kernel.max_data_size;
+ if (data_size) *data_size = item->data_size;
+ if (max_data_size) *max_data_size = item->max_data_size;
*sg_cnt = 1;
*sg = item->_sg;
} else if (item->type == NCR_DATA_USER) {
int ret;
- size_t pagecount, item_size;
-
- ret = ncr_data_item_size(item, 0);
- if (ret < 0) {
- err();
- return ret;
- }
- item_size = ret;
-
- pagecount = PAGECOUNT(item->data.user.ptr, item_size);
+ size_t pagecount = PAGECOUNT(item->data.user.ptr, item->data_size);
if (atomic_add_unless(&item->data.user.pg_used, 1, 1) == 0) {
err();
@@ -150,15 +141,15 @@ int ncr_data_item_get_sg( struct data_item_st* item, struct scatterlist** sg,
return -EOVERFLOW;
}
- ret = __get_userbuf(item->data.user.ptr, item_size, write,
+ ret = __get_userbuf(item->data.user.ptr, item->data_size, write,
pagecount, item->data.user.pg, item->_sg);
if (ret < 0) {
err();
return ret;
}
- if (max_data_size) *max_data_size = item_size;
- if (data_size) *data_size = item_size;
+ if (max_data_size) *max_data_size = item->data_size;
+ if (data_size) *data_size = item->data_size;
*sg = item->_sg;
*sg_cnt = item->data.user.pg_cnt = pagecount;
} else {
@@ -182,45 +173,6 @@ void ncr_data_item_put_sg( struct data_item_st* item)
return;
}
-int ncr_data_item_set_size( struct data_item_st* item, size_t new_size)
-{
- switch(item->type) {
- case NCR_DATA_KERNEL:
- item->data.kernel.data_size = new_size;
-
- return 0;
- case NCR_DATA_USER:
- if (unlikely(copy_to_user(item->data.user.size_ptr, &new_size, sizeof(new_size)))) {
- err();
- return -EFAULT;
- }
- return 0;
- default:
- return -EINVAL;
- }
-}
-
-int ncr_data_item_size( struct data_item_st* item, int max)
-{
-size_t size;
-
- switch(item->type) {
- case NCR_DATA_KERNEL:
- if (max == 0)
- return item->data.kernel.data_size;
- else
- return item->data.kernel.max_data_size;
- case NCR_DATA_USER:
- if (unlikely(copy_from_user(&size, item->data.user.size_ptr, sizeof(size)))) {
- err();
- return -EFAULT;
- }
- return size;
- default:
- return -EINVAL;
- }
-}
-
int ncr_data_item_setd( struct data_item_st* item, const void* data, size_t data_size, unsigned int data_flags)
{
struct scatterlist* sg;
@@ -246,12 +198,7 @@ int ret;
ret = -EINVAL;
goto fail;
}
-
- ret = ncr_data_item_set_size( item, data_size);
- if (ret < 0) {
- err();
- goto fail;
- }
+ item->data_size = data_size;
ret = 0;
fail:
@@ -324,92 +271,35 @@ int ncr_data_init(struct list_sem_st* lst, void __user* arg)
atomic_set(&data->refcnt, 1);
- data->type = NCR_DATA_KERNEL;
+ data->type = init.type;
- data->data.kernel.data = data_alloc(init.max_object_size);
- if (data->data.kernel.data == NULL) {
- err();
- ret = -ENOMEM;
- goto err_data;
- }
- data->data.kernel.max_data_size = init.max_object_size;
-
- if (init.initial_data != NULL) {
- if (unlikely(copy_from_user(data->data.kernel.data, init.initial_data,
- init.initial_data_size))) {
+ if (init.type == NCR_DATA_KERNEL) {
+ data->data.kernel = data_alloc(init.max_object_size);
+ if (data->data.kernel == NULL) {
err();
- _ncr_data_item_put(data);
- return -EFAULT;
+ ret = -ENOMEM;
+ goto err_data;
}
- data->data.kernel.data_size = init.initial_data_size;
- }
-
- down(&lst->sem);
-
- data->desc = _ncr_data_get_new_desc(lst);
-
- list_add(&data->list, &lst->list);
-
- up(&lst->sem);
-
- init.desc = data->desc;
- ret = copy_to_user(arg, &init, sizeof(init));
- if (unlikely(ret)) {
- down(&lst->sem);
- _ncr_data_unlink_item(data);
- up(&lst->sem);
- return -EFAULT;
- }
- return ret;
+ data->max_data_size = init.max_object_size;
- err_data:
- kfree(data);
- err_limits:
- ncr_limits_remove(current_euid(), task_pid_nr(current),
- LIMIT_TYPE_DATA);
- return ret;
-}
-
-int ncr_data_init_user(struct list_sem_st* lst, void __user* arg)
-{
- struct ncr_data_init_user_st init;
- struct data_item_st* data;
- int ret;
-
- ret = ncr_limits_add_and_check(current_euid(), task_pid_nr(current), LIMIT_TYPE_DATA);
- if (ret < 0) {
- err();
- return ret;
- }
-
- if (unlikely(copy_from_user(&init, arg, sizeof(init)))) {
- err();
- ret = -EFAULT;
- goto err_limits;
- }
-
- data = kmalloc(sizeof(*data), GFP_KERNEL);
- if (data == NULL) {
+ if (init.initial_data != NULL) {
+ if (unlikely(copy_from_user(data->data.kernel, init.initial_data,
+ init.initial_data_size))) {
+ err();
+ _ncr_data_item_put(data);
+ return -EFAULT;
+ }
+ data->data_size = init.initial_data_size;
+ }
+ } else if (init.type == NCR_DATA_USER) {
+ data->data.user.ptr = init.initial_data;
+ data->max_data_size = data->data_size = init.initial_data_size;
+ atomic_set(&data->data.user.pg_used, 0);
+ } else {
err();
- ret = -ENOMEM;
- goto err_limits;
+ goto err_data;
}
- memset(data, 0, sizeof(*data));
-
- data->flags = init.flags;
- data->uid = current_euid();
- data->pid = task_pid_nr(current);
-
- atomic_set(&data->refcnt, 1);
-
- data->type = NCR_DATA_USER;
-
- data->data.user.ptr = init.data;
- data->data.user.size_ptr = init.data_size_ptr;
-
- atomic_set(&data->data.user.pg_used, 0);
-
down(&lst->sem);
data->desc = _ncr_data_get_new_desc(lst);
@@ -428,6 +318,8 @@ int ncr_data_init_user(struct list_sem_st* lst, void __user* arg)
}
return ret;
+ err_data:
+ kfree(data);
err_limits:
ncr_limits_remove(current_euid(), task_pid_nr(current),
LIMIT_TYPE_DATA);
@@ -476,7 +368,7 @@ int ncr_data_get(struct list_sem_st* lst, void __user* arg)
return -EINVAL;
}
- if (data->type != NCR_DATA_KERNEL) {
+ if (data->type == NCR_DATA_USER) {
err();
ret = -EINVAL;
goto cleanup;
@@ -488,7 +380,7 @@ int ncr_data_get(struct list_sem_st* lst, void __user* arg)
goto cleanup;
}
- len = min(get.data_size, data->data.kernel.data_size);
+ len = min(get.data_size, data->data_size);
/* update length */
get.data_size = len;
@@ -499,7 +391,7 @@ int ncr_data_get(struct list_sem_st* lst, void __user* arg)
}
if (ret == 0 && len > 0) {
- ret = copy_to_user(get.data, data->data.kernel.data, len);
+ ret = copy_to_user(get.data, data->data.kernel, len);
if (unlikely(ret)) {
err();
ret = -EFAULT;
@@ -529,13 +421,13 @@ int ncr_data_set(struct list_sem_st* lst, void __user* arg)
return -EINVAL;
}
- if (data->type != NCR_DATA_KERNEL) {
+ if (data->type == NCR_DATA_USER) {
err();
ret = -EINVAL;
goto cleanup;
}
- if ((get.data_size > data->data.kernel.max_data_size) ||
+ if ((get.data_size > data->max_data_size) ||
(get.data == NULL && get.data_size != 0)) {
err();
ret = -EINVAL;
@@ -543,14 +435,14 @@ int ncr_data_set(struct list_sem_st* lst, void __user* arg)
}
if (get.data != NULL) {
- if (unlikely(copy_from_user(data->data.kernel.data, get.data,
+ if (unlikely(copy_from_user(data->data.kernel, get.data,
get.data_size))) {
err();
ret = -EFAULT;
goto cleanup;
}
}
- data->data.kernel.data_size = get.data_size;
+ data->data_size = get.data_size;
ret = 0;
diff --git a/ncr-key-wrap.c b/ncr-key-wrap.c
index 67fe10d..d38edca 100644
--- a/ncr-key-wrap.c
+++ b/ncr-key-wrap.c
@@ -51,17 +51,8 @@ uint8_t aes_block[16];
int i,j, ret;
uint8_t * output;
size_t output_size = (n+1)*8;
-size_t max_data_size;
- ret = ncr_data_item_size(odata, 1);
- if (ret < 0) {
- err();
- return ret;
- }
- max_data_size = ret;
-
-
- if (max_data_size < output_size) {
+ if (odata->max_data_size < output_size) {
err();
return -EINVAL;
}
@@ -202,14 +193,6 @@ struct cipher_data ctx;
uint8_t iv[4];
size_t size;
- ret = ncr_data_item_size(wrapped, 0);
- if (ret < 0) {
- err();
- return ret;
- }
- wrapped_key_size = ret;
-
-
if (iv_size != 4) {
memcpy(iv, RFC5649_IV, 4);
} else {
@@ -223,16 +206,16 @@ size_t size;
return ret;
}
- wrapped_key = kmalloc(wrapped_key_size, GFP_KERNEL);
+ wrapped_key = kmalloc(wrapped->data_size, GFP_KERNEL);
if (wrapped_key == NULL) {
err();
ret = -ENOMEM;
goto cleanup;
}
+ wrapped_key_size = wrapped->data_size;
-
- ret = ncr_data_item_getd( wrapped, wrapped_key, wrapped_key_size, wrapped->flags);
+ ret = ncr_data_item_getd( wrapped, wrapped_key, wrapped->data_size, wrapped->flags);
if (ret < 0) {
err();
goto cleanup;
@@ -407,13 +390,6 @@ val64_t A;
int i, ret;
struct cipher_data ctx;
- ret = ncr_data_item_size(wrapped, 0);
- if (ret < 0) {
- err();
- return ret;
- }
- wrapped_key_size = ret;
-
if (iv_size < sizeof(initA)) {
iv_size = sizeof(initA);
iv = initA;
@@ -427,13 +403,15 @@ struct cipher_data ctx;
output->type = NCR_KEY_TYPE_SECRET;
- wrapped_key = kmalloc(wrapped_key_size, GFP_KERNEL);
+ wrapped_key = kmalloc(wrapped->data_size, GFP_KERNEL);
if (wrapped_key == NULL) {
err();
ret = -ENOMEM;
goto cleanup;
}
+ wrapped_key_size = wrapped->data_size;
+
ret = ncr_data_item_getd( wrapped, wrapped_key, wrapped_key_size, wrapped->flags);
if (ret < 0) {
err();
@@ -696,13 +674,7 @@ int ret;
goto fail;
}
- ret = ncr_data_item_size(data, 0);
- if (ret < 0) {
- err();
- return ret;
- }
- sdata_size = ret;
-
+ sdata_size = data->data_size;
sdata = kmalloc(sdata_size, GFP_KERNEL);
if (sdata == NULL) {
err();
diff --git a/ncr-key.c b/ncr-key.c
index 18cb387..c6ce932 100644
--- a/ncr-key.c
+++ b/ncr-key.c
@@ -241,7 +241,6 @@ uint32_t size;
uint32_t data_flags;
int ret;
uint8_t* tmp = NULL;
-size_t max_data_size;
if (unlikely(copy_from_user(&data, arg, sizeof(data)))) {
err();
@@ -263,16 +262,9 @@ size_t max_data_size;
data_flags = key_flags_to_data(item->flags);
- ret = ncr_data_item_size(ditem, 1);
- if (ret < 0) {
- err();
- goto fail;
- }
- max_data_size = ret;
-
switch (item->type) {
case NCR_KEY_TYPE_SECRET:
- if (item->key.secret.size > max_data_size) {
+ if (item->key.secret.size > ditem->max_data_size) {
err();
ret = -EINVAL;
goto fail;
@@ -291,8 +283,8 @@ size_t max_data_size;
break;
case NCR_KEY_TYPE_PUBLIC:
case NCR_KEY_TYPE_PRIVATE:
- size = max_data_size;
-
+ size = ditem->max_data_size;
+
tmp = kmalloc(size, GFP_KERNEL);
if (tmp == NULL) {
err();
@@ -301,6 +293,8 @@ size_t max_data_size;
}
ret = ncr_pk_pack(item, tmp, &size);
+ ditem->data_size = size;
+
if (ret < 0) {
err();
goto fail;
@@ -347,7 +341,6 @@ struct key_item_st* item = NULL;
struct data_item_st* ditem = NULL;
uint8_t *tmp = NULL;
int ret;
-size_t data_size;
if (unlikely(copy_from_user(&data, arg, sizeof(data)))) {
err();
@@ -386,43 +379,36 @@ size_t data_size;
if (data.key_id_size > 0)
memcpy(item->key_id, data.key_id, data.key_id_size);
- ret = ncr_data_item_size(ditem, 0);
- if (ret < 0) {
- err();
- goto fail;
- }
- data_size = ret;
-
switch(item->type) {
case NCR_KEY_TYPE_SECRET:
- if (data_size > NCR_CIPHER_MAX_KEY_LEN) {
+ if (ditem->data_size > NCR_CIPHER_MAX_KEY_LEN) {
err();
ret = -EINVAL;
goto fail;
}
- ret = ncr_data_item_getd(ditem, item->key.secret.data, data_size, item->flags);
+ ret = ncr_data_item_getd(ditem, item->key.secret.data, ditem->data_size, item->flags);
if (ret < 0) {
err();
goto fail;
}
- item->key.secret.size = data_size;
+ item->key.secret.size = ditem->data_size;
break;
case NCR_KEY_TYPE_PRIVATE:
case NCR_KEY_TYPE_PUBLIC:
- tmp = kmalloc(data_size, GFP_KERNEL);
+ tmp = kmalloc(ditem->data_size, GFP_KERNEL);
if (tmp == NULL) {
err();
return -ENOMEM;
}
- ret = ncr_data_item_getd(ditem, tmp, data_size, item->flags);
+ ret = ncr_data_item_getd(ditem, tmp, ditem->data_size, item->flags);
if (ret < 0) {
err();
goto fail;
}
- ret = ncr_pk_unpack( item, tmp, data_size);
+ ret = ncr_pk_unpack( item, tmp, ditem->data_size);
if (ret < 0) {
err();
goto fail;
diff --git a/ncr-sessions.c b/ncr-sessions.c
index 45cd337..dc03367 100644
--- a/ncr-sessions.c
+++ b/ncr-sessions.c
@@ -489,7 +489,7 @@ static int _ncr_session_update(struct ncr_lists* lists, struct ncr_session_op_st
struct data_item_st* odata = NULL;
struct scatterlist *osg;
struct scatterlist *isg;
- size_t osg_size, isg_size, new_size, max_odata_size, idata_size;
+ size_t osg_size, isg_size;
unsigned int osg_cnt, isg_cnt;
sess = ncr_sessions_item_get( &lists->sessions, op->ses);
@@ -534,21 +534,7 @@ static int _ncr_session_update(struct ncr_lists* lists, struct ncr_session_op_st
isg_size = osg_size;
}
- ret = ncr_data_item_size(odata, 1);
- if (ret < 0) {
- err();
- goto fail;
- }
- max_odata_size = ret;
-
- ret = ncr_data_item_size(data, 0);
- if (ret < 0) {
- err();
- goto fail;
- }
- idata_size = ret;
-
- if (max_odata_size < idata_size) {
+ if (odata->max_data_size < data->data_size) {
err();
ret = -EINVAL;
goto fail;
@@ -561,25 +547,21 @@ static int _ncr_session_update(struct ncr_lists* lists, struct ncr_session_op_st
err();
goto fail;
}
-
/* FIXME: handle ciphers that do not require that */
- new_size = idata_size;
+ odata->data_size = data->data_size;
} else { /* public key */
- new_size = osg_size;
+ size_t new_size = osg_size;
ret = ncr_pk_cipher_encrypt(&sess->pk, isg, isg_cnt, isg_size,
osg, osg_cnt, &new_size);
+
+ odata->data_size = new_size;
+
if (ret < 0) {
err();
goto fail;
}
}
- ret = ncr_data_item_set_size(odata, new_size);
- if (ret < 0) {
- err();
- goto fail;
- }
-
break;
case NCR_OP_DECRYPT:
/* obtain data item */
@@ -615,21 +597,7 @@ static int _ncr_session_update(struct ncr_lists* lists, struct ncr_session_op_st
isg_size = osg_size;
}
- ret = ncr_data_item_size(odata, 1);
- if (ret < 0) {
- err();
- goto fail;
- }
- max_odata_size = ret;
-
- ret = ncr_data_item_size(data, 0);
- if (ret < 0) {
- err();
- goto fail;
- }
- idata_size = ret;
-
- if (max_odata_size < idata_size) {
+ if (odata->max_data_size < data->data_size) {
err();
ret = -EINVAL;
goto fail;
@@ -643,24 +611,20 @@ static int _ncr_session_update(struct ncr_lists* lists, struct ncr_session_op_st
goto fail;
}
/* FIXME: handle ciphers that do not require that */
- new_size = idata_size;
+ odata->data_size = data->data_size;
} else { /* public key */
size_t new_size = osg_size;
ret = ncr_pk_cipher_decrypt(&sess->pk, isg, isg_cnt, isg_size,
osg, osg_cnt, &new_size);
+
+ odata->data_size = new_size;
+
if (ret < 0) {
err();
goto fail;
}
}
- ret = ncr_data_item_set_size(odata, new_size);
- if (ret < 0) {
- err();
- goto fail;
- }
-
-
break;
case NCR_OP_SIGN:
@@ -769,7 +733,7 @@ static int _ncr_session_final(struct ncr_lists* lists, struct ncr_session_op_st*
int digest_size;
uint8_t digest[NCR_HASH_MAX_OUTPUT_SIZE];
struct scatterlist *osg;
- size_t osg_size, odata_size, max_odata_size;
+ size_t osg_size;
unsigned int osg_cnt;
sess = ncr_sessions_item_get( &lists->sessions, op->ses);
@@ -817,13 +781,6 @@ static int _ncr_session_final(struct ncr_lists* lists, struct ncr_session_op_st*
goto fail;
}
- ret = ncr_data_item_size(odata, 0);
- if (ret < 0) {
- err();
- goto fail;
- }
- odata_size = ret;
-
if (algo_is_hmac(sess->algorithm)) {
uint8_t vdigest[digest_size];
@@ -832,8 +789,8 @@ static int _ncr_session_final(struct ncr_lists* lists, struct ncr_session_op_st*
err();
goto fail;
}
-
- if (digest_size != odata_size ||
+
+ if (digest_size != odata->data_size ||
memcmp(vdigest, digest, digest_size) != 0) {
op->err = NCR_VERIFICATION_FAILED;
@@ -872,15 +829,8 @@ static int _ncr_session_final(struct ncr_lists* lists, struct ncr_session_op_st*
goto fail;
}
- ret = ncr_data_item_size(odata, 1);
- if (ret < 0) {
- err();
- goto fail;
- }
- max_odata_size = ret;
-
digest_size = sess->hash.digestsize;
- if (digest_size == 0 || max_odata_size < digest_size) {
+ if (digest_size == 0 || odata->max_data_size < digest_size) {
err();
ret = -EINVAL;
goto fail;
@@ -917,12 +867,7 @@ static int _ncr_session_final(struct ncr_lists* lists, struct ncr_session_op_st*
err();
goto fail;
}
-
- ret = ncr_data_item_set_size(odata, new_size);
- if (ret < 0) {
- err();
- goto fail;
- }
+ odata->data_size = new_size;
}
break;
diff --git a/ncr.c b/ncr.c
index be0cdc8..5740580 100644
--- a/ncr.c
+++ b/ncr.c
@@ -126,8 +126,6 @@ ncr_ioctl(struct ncr_lists* lst, struct file *filp,
switch (cmd) {
case NCRIO_DATA_INIT:
return ncr_data_init(&lst->data, arg);
- case NCRIO_DATA_INIT_USER:
- return ncr_data_init_user(&lst->data, arg);
case NCRIO_DATA_GET:
return ncr_data_get(&lst->data, arg);
case NCRIO_DATA_SET:
diff --git a/ncr.h b/ncr.h
index 3015889..844cddb 100644
--- a/ncr.h
+++ b/ncr.h
@@ -63,32 +63,30 @@ typedef enum {
typedef int ncr_data_t;
#define NCR_DATA_INVALID (ncr_data_t)(0)
+typedef enum {
+ NCR_DATA_KERNEL,
+ NCR_DATA_USER,
+} ncr_data_type_t;
+
/* When initializing a data_t we can initialize it as a kernel data object
* or as an object that points to userspace data.
*/
struct ncr_data_init_st {
ncr_data_t desc;
+ ncr_data_type_t type;
size_t max_object_size;
unsigned int flags;
void __user *initial_data; /* can be null */
size_t initial_data_size;
};
-struct ncr_data_init_user_st {
- ncr_data_t desc;
- unsigned int flags;
- void __user *data; /* can be null */
- size_t __user* data_size_ptr;
-};
-
struct ncr_data_st {
ncr_data_t desc;
void __user* data;
size_t data_size; /* rw in get */
};
-#define NCRIO_DATA_INIT _IOWR('c', 200, struct ncr_data_init_st)
-#define NCRIO_DATA_INIT_USER _IOWR('c', 200, struct ncr_data_init_user_st)
+#define NCRIO_DATA_INIT _IOWR('c', 200, struct ncr_data_init_st)
#define NCRIO_DATA_GET _IOWR('c', 201, struct ncr_data_st)
#define NCRIO_DATA_SET _IOR('c', 202, struct ncr_data_st)
#define NCRIO_DATA_DEINIT _IOR('c', 203, ncr_data_t)
diff --git a/ncr_int.h b/ncr_int.h
index c5be7e5..185b3a3 100644
--- a/ncr_int.h
+++ b/ncr_int.h
@@ -30,11 +30,6 @@ struct session_item_st {
ncr_session_t desc;
};
-typedef enum {
- NCR_DATA_KERNEL,
- NCR_DATA_USER,
-} ncr_data_type_t;
-
#define MAX_DATA_PAGES 64
struct data_item_st {
struct list_head list;
@@ -43,16 +38,14 @@ struct data_item_st {
* not an issue).
*/
+ size_t data_size;
+ size_t max_data_size;
+
struct scatterlist _sg[MAX_DATA_PAGES]; /* do not access directly */
union {
- struct {
- uint8_t* data;
- size_t data_size;
- size_t max_data_size;
- } kernel;
+ uint8_t* kernel;
struct {
uint8_t* __user ptr;
- size_t* __user size_ptr;
struct page *pg[MAX_DATA_PAGES];
size_t pg_cnt;
atomic_t pg_used;
@@ -127,7 +120,6 @@ int ncr_data_set(struct list_sem_st*, void __user* arg);
int ncr_data_get(struct list_sem_st*, void __user* arg);
int ncr_data_deinit(struct list_sem_st*, void __user* arg);
int ncr_data_init(struct list_sem_st*, void __user* arg);
-int ncr_data_init_user(struct list_sem_st*, void __user* arg);
void ncr_data_list_deinit(struct list_sem_st*);
struct data_item_st* ncr_data_item_get( struct list_sem_st* lst, ncr_data_t desc);
void _ncr_data_item_put( struct data_item_st* item);
@@ -137,8 +129,7 @@ int ncr_data_item_get_sg( struct data_item_st* item, struct scatterlist** sg,
void ncr_data_item_put_sg( struct data_item_st* item);
int ncr_data_item_setd( struct data_item_st* item, const void* data, size_t data_size, unsigned int data_flags);
int ncr_data_item_getd( struct data_item_st* item, void* data, size_t data_size, unsigned int data_flags);
-int ncr_data_item_size( struct data_item_st* item, int max);
-int ncr_data_item_set_size( struct data_item_st* item, size_t new_size);
+
int ncr_key_init(struct list_sem_st*, void __user* arg);
int ncr_key_deinit(struct list_sem_st*, void __user* arg);
generated by cgit (git 2.34.1) at 2025-07-03 05:19:43 +0000