From eef7de54be0cd38abb689de7b0a749154b04c694 Mon Sep 17 00:00:00 2001 From: Miloslav Trmač Date: Wed, 18 Aug 2010 05:31:14 +0200 Subject: Replace ncr_algorithm_t by NLA_NUL_STRING --- examples/ncr.c | 145 +++++++++++++++++++++++++++++------------------------- examples/pk.c | 77 ++++++++++++++++------------- examples/speed.c | 25 +++++----- ncr-int.h | 24 ++++++++- ncr-key-storage.c | 6 ++- ncr-key.c | 4 +- ncr-pk.c | 3 +- ncr-sessions.c | 96 +++++++++++++++++++++--------------- ncr.h | 40 ++------------- utils.c | 6 +-- 10 files changed, 227 insertions(+), 199 deletions(-) diff --git a/examples/ncr.c b/examples/ncr.c index facecd88ec0..a9b0cea70d2 100644 --- a/examples/ncr.c +++ b/examples/ncr.c @@ -22,6 +22,9 @@ #define ALIGN_NL __attribute__((aligned(NLA_ALIGNTO))) +#define ALG_AES_CBC "cbc(aes)" +#define ALG_AES_ECB "ecb(aes)" + static void randomize_data(uint8_t * data, size_t data_size) { int i; @@ -40,7 +43,7 @@ test_ncr_key(int cfd) struct __attribute__((packed)) { struct ncr_key_generate f; struct nlattr algo_head ALIGN_NL; - uint32_t algo ALIGN_NL; + char algo[sizeof(ALG_AES_CBC)] ALIGN_NL; struct nlattr flags_head ALIGN_NL; uint32_t flags ALIGN_NL; struct nlattr bits_head ALIGN_NL; @@ -64,7 +67,7 @@ test_ncr_key(int cfd) struct nlattr type_head ALIGN_NL; uint32_t type ALIGN_NL; struct nlattr algo_head ALIGN_NL; - uint32_t algo ALIGN_NL; + char algo[sizeof(ALG_AES_CBC)] ALIGN_NL; struct nlattr flags_head ALIGN_NL; uint32_t flags ALIGN_NL; } kimport; @@ -106,7 +109,7 @@ test_ncr_key(int cfd) kimport.type = NCR_KEY_TYPE_SECRET; kimport.algo_head.nla_len = NLA_HDRLEN + sizeof(kimport.algo); kimport.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kimport.algo = NCR_ALG_AES_CBC; + strcpy(kimport.algo, ALG_AES_CBC); kimport.flags_head.nla_len = NLA_HDRLEN + sizeof(kimport.flags); kimport.flags_head.nla_type = NCR_ATTR_KEY_FLAGS; kimport.flags = NCR_KEY_FLAG_EXPORTABLE; @@ -162,7 +165,7 @@ test_ncr_key(int cfd) kgen.f.key = key; kgen.algo_head.nla_len = NLA_HDRLEN + sizeof(kgen.algo); kgen.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kgen.algo = NCR_ALG_AES_CBC; + strcpy(kgen.algo, ALG_AES_CBC); kgen.flags_head.nla_len = NLA_HDRLEN + sizeof(kgen.flags); kgen.flags_head.nla_type = NCR_ATTR_KEY_FLAGS; kgen.flags = NCR_KEY_FLAG_EXPORTABLE; @@ -227,10 +230,6 @@ test_ncr_key(int cfd) for (;;) { void *data; - if (nla->nla_len < NLA_HDRLEN + sizeof(uint32_t)) { - fprintf(stderr, "Attribute too small\n"); - return 1; - } if (nla->nla_len > kinfo.f.output_size - ((char *)nla - (char *)&kinfo)) { fprintf(stderr, "Attributes overflow\n"); @@ -239,13 +238,26 @@ test_ncr_key(int cfd) data = (char *)nla + NLA_HDRLEN; switch (nla->nla_type) { case NCR_ATTR_ALGORITHM: - if (*(uint32_t *)data != NCR_ALG_AES_CBC) { + if (nla->nla_len < NLA_HDRLEN + 1) { + fprintf(stderr, "Attribute too small\n"); + return 1; + } + if (((char *)data)[nla->nla_len - NLA_HDRLEN - 1] + != 0) { + fprintf(stderr, "NUL missing\n"); + return 1; + } + if (strcmp(data, ALG_AES_CBC) != 0) { fprintf(stderr, "Unexpected algorithm\n"); return 1; } got_algo++; break; case NCR_ATTR_KEY_FLAGS: + if (nla->nla_len < NLA_HDRLEN + sizeof(uint32_t)) { + fprintf(stderr, "Attribute too small\n"); + return 1; + } if (*(uint32_t *)data != NCR_KEY_FLAG_EXPORTABLE) { fprintf(stderr, "Unexpected key flags\n"); return 1; @@ -253,6 +265,10 @@ test_ncr_key(int cfd) got_flags++; break; case NCR_ATTR_KEY_TYPE: + if (nla->nla_len < NLA_HDRLEN + sizeof(uint32_t)) { + fprintf(stderr, "Attribute too small\n"); + return 1; + } if (*(uint32_t *)data != NCR_KEY_TYPE_SECRET) { fprintf(stderr, "Unexpected key type\n"); return 1; @@ -294,7 +310,7 @@ test_ncr_key(int cfd) kgen.f.key = key; kgen.algo_head.nla_len = NLA_HDRLEN + sizeof(kgen.algo); kgen.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kgen.algo = NCR_ALG_AES_CBC; + strcpy(kgen.algo, ALG_AES_CBC); kgen.flags_head.nla_len = NLA_HDRLEN + sizeof(kgen.flags); kgen.flags_head.nla_type = NCR_ATTR_KEY_FLAGS; kgen.flags = 0; @@ -346,7 +362,7 @@ test_ncr_wrap_key(int cfd) struct nlattr type_head ALIGN_NL; uint32_t type ALIGN_NL; struct nlattr algo_head ALIGN_NL; - uint32_t algo ALIGN_NL; + char algo[sizeof(ALG_AES_CBC)] ALIGN_NL; struct nlattr flags_head ALIGN_NL; uint32_t flags ALIGN_NL; } kimport; @@ -360,7 +376,7 @@ test_ncr_wrap_key(int cfd) struct nlattr wrap_algo_head ALIGN_NL; uint32_t wrap_algo ALIGN_NL; struct nlattr algo_head ALIGN_NL; - uint32_t algo ALIGN_NL; + char algo[sizeof(ALG_AES_CBC)] ALIGN_NL; } kunwrap; uint8_t data[WRAPPED_KEY_DATA_SIZE]; int data_size; @@ -394,7 +410,7 @@ test_ncr_wrap_key(int cfd) kimport.type = NCR_KEY_TYPE_SECRET; kimport.algo_head.nla_len = NLA_HDRLEN + sizeof(kimport.algo); kimport.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kimport.algo = NCR_ALG_AES_CBC; + strcpy(kimport.algo, ALG_AES_CBC); kimport.flags_head.nla_len = NLA_HDRLEN + sizeof(kimport.flags); kimport.flags_head.nla_type = NCR_ATTR_KEY_FLAGS; kimport.flags = NCR_KEY_FLAG_EXPORTABLE|NCR_KEY_FLAG_WRAPPING; @@ -428,7 +444,7 @@ test_ncr_wrap_key(int cfd) kimport.type = NCR_KEY_TYPE_SECRET; kimport.algo_head.nla_len = NLA_HDRLEN + sizeof(kimport.algo); kimport.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kimport.algo = NCR_ALG_AES_CBC; + strcpy(kimport.algo, ALG_AES_CBC); kimport.flags_head.nla_len = NLA_HDRLEN + sizeof(kimport.flags); kimport.flags_head.nla_type = NCR_ATTR_KEY_FLAGS; kimport.flags = NCR_KEY_FLAG_EXPORTABLE|NCR_KEY_FLAG_WRAPPABLE; @@ -500,7 +516,7 @@ test_ncr_wrap_key(int cfd) kunwrap.wrap_algo = NCR_WALG_AES_RFC3394; kunwrap.algo_head.nla_len = NLA_HDRLEN + sizeof(kunwrap.algo); kunwrap.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kunwrap.algo = NCR_ALG_AES_CBC; + strcpy(kunwrap.algo, ALG_AES_CBC); if (ioctl(cfd, NCRIO_KEY_UNWRAP, &kunwrap)) { perror("ioctl(NCRIO_KEY_UNWRAP)"); @@ -556,7 +572,7 @@ test_ncr_wrap_key2(int cfd) struct nlattr type_head ALIGN_NL; uint32_t type ALIGN_NL; struct nlattr algo_head ALIGN_NL; - uint32_t algo ALIGN_NL; + char algo[sizeof(ALG_AES_CBC)] ALIGN_NL; struct nlattr flags_head ALIGN_NL; uint32_t flags ALIGN_NL; } kimport; @@ -599,7 +615,7 @@ test_ncr_wrap_key2(int cfd) kimport.type = NCR_KEY_TYPE_SECRET; kimport.algo_head.nla_len = NLA_HDRLEN + sizeof(kimport.algo); kimport.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kimport.algo = NCR_ALG_AES_CBC; + strcpy(kimport.algo, ALG_AES_CBC); kimport.flags_head.nla_len = NLA_HDRLEN + sizeof(kimport.flags); kimport.flags_head.nla_type = NCR_ATTR_KEY_FLAGS; kimport.flags = NCR_KEY_FLAG_EXPORTABLE|NCR_KEY_FLAG_WRAPPING; @@ -631,7 +647,7 @@ test_ncr_wrap_key2(int cfd) kimport.type = NCR_KEY_TYPE_SECRET; kimport.algo_head.nla_len = NLA_HDRLEN + sizeof(kimport.algo); kimport.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kimport.algo = NCR_ALG_AES_CBC; + strcpy(kimport.algo, ALG_AES_CBC); kimport.flags_head.nla_len = NLA_HDRLEN + sizeof(kimport.flags); kimport.flags_head.nla_type = NCR_ATTR_KEY_FLAGS; kimport.flags = NCR_KEY_FLAG_EXPORTABLE|NCR_KEY_FLAG_WRAPPABLE; @@ -675,7 +691,7 @@ test_ncr_store_wrap_key(int cfd) struct nlattr type_head ALIGN_NL; uint32_t type ALIGN_NL; struct nlattr algo_head ALIGN_NL; - uint32_t algo ALIGN_NL; + char algo[sizeof(ALG_AES_CBC)] ALIGN_NL; struct nlattr flags_head ALIGN_NL; uint32_t flags ALIGN_NL; } kimport; @@ -715,7 +731,7 @@ test_ncr_store_wrap_key(int cfd) kimport.type = NCR_KEY_TYPE_SECRET; kimport.algo_head.nla_len = NLA_HDRLEN + sizeof(kimport.algo); kimport.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kimport.algo = NCR_ALG_AES_CBC; + strcpy(kimport.algo, ALG_AES_CBC); kimport.flags_head.nla_len = NLA_HDRLEN + sizeof(kimport.flags); kimport.flags_head.nla_type = NCR_ATTR_KEY_FLAGS; kimport.flags = NCR_KEY_FLAG_EXPORTABLE|NCR_KEY_FLAG_WRAPPABLE; @@ -837,7 +853,7 @@ test_ncr_aes(int cfd) struct nlattr type_head ALIGN_NL; uint32_t type ALIGN_NL; struct nlattr algo_head ALIGN_NL; - uint32_t algo ALIGN_NL; + char algo[sizeof(ALG_AES_ECB)] ALIGN_NL; struct nlattr flags_head ALIGN_NL; uint32_t flags ALIGN_NL; } kimport; @@ -846,7 +862,7 @@ test_ncr_aes(int cfd) struct __attribute__((packed)) { struct ncr_session_once f; struct nlattr algo_head ALIGN_NL; - uint32_t algo ALIGN_NL; + char algo[sizeof(ALG_AES_ECB)] ALIGN_NL; struct nlattr key_head ALIGN_NL; uint32_t key ALIGN_NL; struct nlattr input_head ALIGN_NL; @@ -880,7 +896,7 @@ test_ncr_aes(int cfd) kimport.type = NCR_KEY_TYPE_SECRET; kimport.algo_head.nla_len = NLA_HDRLEN + sizeof(kimport.algo); kimport.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kimport.algo = NCR_ALG_AES_CBC; + strcpy(kimport.algo, ALG_AES_ECB); kimport.flags_head.nla_len = NLA_HDRLEN + sizeof(kimport.flags); kimport.flags_head.nla_type = NCR_ATTR_KEY_FLAGS; kimport.flags = NCR_KEY_FLAG_EXPORTABLE; @@ -896,7 +912,7 @@ test_ncr_aes(int cfd) op.f.op = NCR_OP_ENCRYPT; op.algo_head.nla_len = NLA_HDRLEN + sizeof(op.algo); op.algo_head.nla_type = NCR_ATTR_ALGORITHM; - op.algo = NCR_ALG_AES_ECB; + strcpy(op.algo, ALG_AES_ECB); op.key_head.nla_len = NLA_HDRLEN + sizeof(op.key); op.key_head.nla_type = NCR_ATTR_KEY; op.key = key; @@ -950,7 +966,7 @@ test_ncr_aes(int cfd) kimport.type = NCR_KEY_TYPE_SECRET; kimport.algo_head.nla_len = NLA_HDRLEN + sizeof(kimport.algo); kimport.algo_head.nla_type = NCR_ATTR_ALGORITHM; - kimport.algo = NCR_ALG_AES_CBC; + strcpy(kimport.algo, ALG_AES_CBC); kimport.flags_head.nla_len = NLA_HDRLEN + sizeof(kimport.flags); kimport.flags_head.nla_type = NCR_ATTR_KEY_FLAGS; kimport.flags = NCR_KEY_FLAG_EXPORTABLE; @@ -966,7 +982,7 @@ test_ncr_aes(int cfd) op.f.op = NCR_OP_DECRYPT; op.algo_head.nla_len = NLA_HDRLEN + sizeof(op.algo); op.algo_head.nla_type = NCR_ATTR_ALGORITHM; - op.algo = NCR_ALG_AES_ECB; + strcpy(op.algo, ALG_AES_ECB); op.key_head.nla_len = NLA_HDRLEN + sizeof(op.key); op.key_head.nla_type = NCR_ATTR_KEY; op.key = key; @@ -1010,8 +1026,7 @@ test_ncr_aes(int cfd) } struct hash_vectors_st { - const char* name; - ncr_algorithm_t algorithm; + const char* algorithm; const uint8_t* key; /* if hmac */ int key_size; const uint8_t* plaintext; @@ -1021,8 +1036,7 @@ struct hash_vectors_st { ncr_crypto_op_t op; } hash_vectors[] = { { - .name = "SHA1", - .algorithm = NCR_ALG_SHA1, + .algorithm = "sha1", .key = NULL, .plaintext = (uint8_t*)"what do ya want for nothing?", .plaintext_size = sizeof("what do ya want for nothing?")-1, @@ -1031,8 +1045,7 @@ struct hash_vectors_st { .op = NCR_OP_SIGN, }, { - .name = "HMAC-MD5", - .algorithm = NCR_ALG_HMAC_MD5, + .algorithm = "hmac(md5)", .key = (uint8_t*)"Jefe", .key_size = 4, .plaintext = (uint8_t*)"what do ya want for nothing?", @@ -1043,8 +1056,7 @@ struct hash_vectors_st { }, /* from rfc4231 */ { - .name = "HMAC-SHA224", - .algorithm = NCR_ALG_HMAC_SHA2_224, + .algorithm = "hmac(sha224)", .key = (uint8_t*)"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", .key_size = 20, .plaintext = (uint8_t*)"Hi There", @@ -1054,8 +1066,7 @@ struct hash_vectors_st { .op = NCR_OP_SIGN, }, { - .name = "HMAC-SHA256", - .algorithm = NCR_ALG_HMAC_SHA2_256, + .algorithm = "hmac(sha256)", .key = (uint8_t*)"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", .key_size = 20, .plaintext = (uint8_t*)"Hi There", @@ -1065,8 +1076,7 @@ struct hash_vectors_st { .op = NCR_OP_SIGN, }, { - .name = "HMAC-SHA384", - .algorithm = NCR_ALG_HMAC_SHA2_384, + .algorithm = "hmac(sha384)", .key = (uint8_t*)"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", .key_size = 20, .plaintext = (uint8_t*)"Hi There", @@ -1076,8 +1086,7 @@ struct hash_vectors_st { .op = NCR_OP_SIGN, }, { - .name = "HMAC-SHA512", - .algorithm = NCR_ALG_HMAC_SHA2_512, + .algorithm = "hmac(sha512)", .key = (uint8_t*)"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", .key_size = 20, .plaintext = (uint8_t*)"Hi There", @@ -1101,24 +1110,24 @@ test_ncr_hash(int cfd) uint8_t id[2] ALIGN_NL; struct nlattr type_head ALIGN_NL; uint32_t type ALIGN_NL; - struct nlattr algo_head ALIGN_NL; - uint32_t algo ALIGN_NL; struct nlattr flags_head ALIGN_NL; uint32_t flags ALIGN_NL; + struct nlattr algo_head ALIGN_NL; + char algo[128] ALIGN_NL; } kimport; uint8_t data[HASH_DATA_SIZE]; int i, j; size_t data_size; struct __attribute__((packed)) { struct ncr_session_once f; - struct nlattr algo_head ALIGN_NL; - uint32_t algo ALIGN_NL; struct nlattr key_head ALIGN_NL; uint32_t key ALIGN_NL; struct nlattr input_head ALIGN_NL; struct ncr_session_input_data input ALIGN_NL; struct nlattr output_head ALIGN_NL; struct ncr_session_output_buffer output ALIGN_NL; + struct nlattr algo_head ALIGN_NL; + char algo[128] ALIGN_NL; } op; /* convert it to key */ @@ -1130,13 +1139,14 @@ test_ncr_hash(int cfd) fprintf(stdout, "Tests on Hashes\n"); for (i=0;iversion = THIS_VERSION; pkey->type = key->type; pkey->flags = key->flags; - pkey->algorithm = key->algorithm->algo; + BUG_ON(strlen(key->algorithm->kstr) > sizeof(pkey->algorithm) - 1); + strcpy(pkey->algorithm, key->algorithm->kstr); pkey->key_id_size = key->key_id_size; memcpy(pkey->key_id, key->key_id, key->key_id_size); @@ -95,6 +96,7 @@ int key_from_storage_data(struct key_item_st* key, const void* data, size_t data int ret; if (data_size != sizeof(*pkey) || pkey->version != THIS_VERSION + || memchr(pkey->algorithm, '\0', sizeof(pkey->algorithm)) == NULL || pkey->key_id_size > MAX_KEY_ID_SIZE) { err(); return -EINVAL; diff --git a/ncr-key.c b/ncr-key.c index 56708d8fba7..6e682451375 100644 --- a/ncr-key.c +++ b/ncr-key.c @@ -624,8 +624,8 @@ int ret; ret = ncr_out_put_u32(out, *attr, item->type); break; case NCR_ATTR_ALGORITHM: - ret = ncr_out_put_u32(out, *attr, - item->algorithm->algo); + ret = ncr_out_put_string(out, *attr, + item->algorithm->kstr); break; default: break; /* Silently ignore */ diff --git a/ncr-pk.c b/ncr-pk.c index ed904d60d4a..ecac4c777b2 100644 --- a/ncr-pk.c +++ b/ncr-pk.c @@ -123,7 +123,8 @@ static int ncr_pk_make_public_and_id( struct key_item_st * private, struct key_i } key_id_size = MAX_KEY_ID_SIZE; - cret = hash_memory(_ncr_algo_to_properties(NCR_ALG_SHA1), tmp, max_size, private->key_id, &key_id_size); + cret = hash_memory(_ncr_algo_to_properties("sha1"), tmp, max_size, + private->key_id, &key_id_size); if (cret != CRYPT_OK) { err(); ret = _ncr_tomerr(cret); diff --git a/ncr-sessions.c b/ncr-sessions.c index 8f3e721de8d..41f8a4c9000 100644 --- a/ncr-sessions.c +++ b/ncr-sessions.c @@ -130,87 +130,91 @@ err_sess: } static const struct algo_properties_st algo_properties[] = { - { .algo = NCR_ALG_NULL, .kstr = "ecb(cipher_null)", +#define KSTR(x) .kstr = x, .kstr_len = sizeof(x) - 1 + { .algo = NCR_ALG_NULL, KSTR("ecb(cipher_null)"), .needs_iv = 0, .is_symmetric=1, .can_encrypt=1, .key_type = NCR_KEY_TYPE_INVALID }, - { .algo = NCR_ALG_3DES_CBC, .kstr = "cbc(des3_ede)", + { .algo = NCR_ALG_3DES_CBC, KSTR("cbc(des3_ede)"), .needs_iv = 1, .is_symmetric=1, .can_encrypt=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_AES_CBC, .kstr = "cbc(aes)", + { KSTR("cbc(aes)"), .needs_iv = 1, .is_symmetric=1, .can_encrypt=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_CAMELLIA_CBC, .kstr = "cbc(camelia)", + { KSTR("cbc(camelia)"), .needs_iv = 1, .is_symmetric=1, .can_encrypt=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_AES_CTR, .kstr = "ctr(aes)", + { KSTR("ctr(aes)"), .needs_iv = 1, .is_symmetric=1, .can_encrypt=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_CAMELLIA_CTR, .kstr = "ctr(camelia)", + { KSTR("ctr(camelia)"), .needs_iv = 1, .is_symmetric=1, .can_encrypt=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_ARCFOUR, .kstr = NULL, + { KSTR("ecb(aes)"), .needs_iv = 0, .is_symmetric=1, .can_encrypt=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_AES_ECB, .kstr = "ecb(aes)", + { KSTR("ecb(camelia)"), .needs_iv = 0, .is_symmetric=1, .can_encrypt=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_CAMELLIA_ECB, .kstr = "ecb(camelia)", - .needs_iv = 0, .is_symmetric=1, .can_encrypt=1, - .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_SHA1, .kstr = "sha1", + { .algo = NCR_ALG_SHA1, KSTR("sha1"), .digest_size = 20, .can_digest=1, .key_type = NCR_KEY_TYPE_INVALID }, - { .algo = NCR_ALG_MD5, .kstr = "md5", + { .algo = NCR_ALG_MD5, KSTR("md5"), .digest_size = 16, .can_digest=1, .key_type = NCR_KEY_TYPE_INVALID }, - { .algo = NCR_ALG_SHA2_224, .kstr = "sha224", + { .algo = NCR_ALG_SHA2_224, KSTR("sha224"), .digest_size = 28, .can_digest=1, .key_type = NCR_KEY_TYPE_INVALID }, - { .algo = NCR_ALG_SHA2_256, .kstr = "sha256", + { .algo = NCR_ALG_SHA2_256, KSTR("sha256"), .digest_size = 32, .can_digest=1, .key_type = NCR_KEY_TYPE_INVALID }, - { .algo = NCR_ALG_SHA2_384, .kstr = "sha384", + { .algo = NCR_ALG_SHA2_384, KSTR("sha384"), .digest_size = 48, .can_digest=1, .key_type = NCR_KEY_TYPE_INVALID }, - { .algo = NCR_ALG_SHA2_512, .kstr = "sha512", + { .algo = NCR_ALG_SHA2_512, KSTR("sha512"), .digest_size = 64, .can_digest=1, .key_type = NCR_KEY_TYPE_INVALID }, - { .algo = NCR_ALG_HMAC_SHA1, .is_hmac = 1, .kstr = "hmac(sha1)", + { .is_hmac = 1, KSTR("hmac(sha1)"), .digest_size = 20, .can_sign=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_HMAC_MD5, .is_hmac = 1, .kstr = "hmac(md5)", + { .is_hmac = 1, KSTR("hmac(md5)"), .digest_size = 16, .can_sign=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_HMAC_SHA2_224, .is_hmac = 1, .kstr = "hmac(sha224)", + { .is_hmac = 1, KSTR("hmac(sha224)"), .digest_size = 28, .can_sign=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_HMAC_SHA2_256, .is_hmac = 1, .kstr = "hmac(sha256)", + { .is_hmac = 1, KSTR("hmac(sha256)"), .digest_size = 32, .can_sign=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_HMAC_SHA2_384, .is_hmac = 1, .kstr = "hmac(sha384)", + { .is_hmac = 1, KSTR("hmac(sha384)"), .digest_size = 48, .can_sign=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_HMAC_SHA2_512, .is_hmac = 1, .kstr = "hmac(sha512)", + { .is_hmac = 1, KSTR("hmac(sha512)"), .digest_size = 64, .can_sign=1, .key_type = NCR_KEY_TYPE_SECRET }, - { .algo = NCR_ALG_RSA, .kstr = NULL, .is_pk = 1, + /* NOTE: These algorithm names are not available through the kernel API + (yet). */ + { .algo = NCR_ALG_RSA, KSTR("rsa"), .is_pk = 1, .can_encrypt=1, .can_sign=1, .key_type = NCR_KEY_TYPE_PUBLIC }, - { .algo = NCR_ALG_DSA, .kstr = NULL, .is_pk = 1, + { .algo = NCR_ALG_DSA, KSTR("dsa"), .is_pk = 1, .can_sign=1, .key_type = NCR_KEY_TYPE_PUBLIC }, - { .algo = NCR_ALG_DH, .kstr = NULL, .is_pk = 1, + { .algo = NCR_ALG_DH, KSTR("dh"), .is_pk = 1, .can_kx=1, .key_type = NCR_KEY_TYPE_PUBLIC }, - { .algo = NCR_ALG_NONE } - +#undef KSTR }; -const struct algo_properties_st *_ncr_algo_to_properties(ncr_algorithm_t algo) +/* The lookups by string are inefficient - can we look up all we need from + crypto API? */ +const struct algo_properties_st *_ncr_algo_to_properties(const char *algo) { - ncr_algorithm_t a; - int i = 0; - - for (i = 0; (a = algo_properties[i].algo) != NCR_ALG_NONE; i++) { - if (a == algo) - return &algo_properties[i]; + const struct algo_properties_st *a; + size_t name_len; + + name_len = strlen(algo); + for (a = algo_properties; + a < algo_properties + ARRAY_SIZE(algo_properties); a++) { + if (a->kstr_len == name_len + && memcmp(a->kstr, algo, name_len) == 0) + return a; } return NULL; @@ -218,9 +222,21 @@ const struct algo_properties_st *_ncr_algo_to_properties(ncr_algorithm_t algo) const struct algo_properties_st *_ncr_nla_to_properties(const struct nlattr *nla) { + const struct algo_properties_st *a; + size_t name_len; + if (nla == NULL) return NULL; - return _ncr_algo_to_properties(nla_get_u32(nla)); + + /* nla_len() >= 1 ensured by validate_nla() case NLA_NUL_STRING */ + name_len = nla_len(nla) - 1; + for (a = algo_properties; + a < algo_properties + ARRAY_SIZE(algo_properties); a++) { + if (a->kstr_len == name_len + && memcmp(a->kstr, nla_data(nla), name_len + 1) == 0) + return a; + } + return NULL; } static int key_item_get_nla_read(struct key_item_st **st, @@ -294,7 +310,7 @@ static int _ncr_session_init(struct ncr_lists *lists, ncr_crypto_op_t op, if (ns->algorithm->algo == NCR_ALG_NULL) keysize = 0; - if (ns->algorithm->kstr == NULL) { + if (ns->algorithm->is_pk) { err(); ret = -EINVAL; goto fail; @@ -341,7 +357,7 @@ static int _ncr_session_init(struct ncr_lists *lists, ncr_crypto_op_t op, } if (ns->algorithm->can_digest) { - if (ns->algorithm->kstr == NULL) { + if (ns->algorithm->is_pk) { err(); ret = -EINVAL; goto fail; @@ -371,7 +387,7 @@ static int _ncr_session_init(struct ncr_lists *lists, ncr_crypto_op_t op, } if (ns->algorithm->is_hmac && ns->key->type == NCR_KEY_TYPE_SECRET) { - if (ns->algorithm->kstr == NULL) { + if (ns->algorithm->is_pk) { err(); ret = -EINVAL; goto fail; @@ -399,7 +415,7 @@ static int _ncr_session_init(struct ncr_lists *lists, ncr_crypto_op_t op, goto fail; } - if (sign_hash->kstr == NULL) { + if (sign_hash->is_pk) { err(); ret = -EINVAL; goto fail; diff --git a/ncr.h b/ncr.h index bc681acf43d..3dae3f38eb8 100644 --- a/ncr.h +++ b/ncr.h @@ -30,10 +30,9 @@ of attributes used for the frequent operations? */ enum { NCR_ATTR_UNSPEC, /* 0 is special in lib/nlattr.c. */ - /* FIXME: Use NLA_STRING for this, later */ - NCR_ATTR_ALGORITHM, /* NLA_U32 - ncr_algorithm_t */ + NCR_ATTR_ALGORITHM, /* NLA_NUL_STRING */ NCR_ATTR_DERIVATION_ALGORITHM, /* NLA_U32 - ncr_algorithm_t */ - NCR_ATTR_SIGNATURE_HASH_ALGORITHM, /* NLA_U32 - ncr_algorithm_t */ + NCR_ATTR_SIGNATURE_HASH_ALGORITHM, /* NLA_NUL_STRING */ NCR_ATTR_WRAPPING_ALGORITHM, /* NLA_U32 - ncr_wrap_algorithm_t */ NCR_ATTR_UPDATE_INPUT_DATA, /* NLA_BINARY - ncr_session_input_data */ /* NLA_BINARY - ncr_session_output_buffer */ @@ -51,7 +50,7 @@ enum { NCR_ATTR_RSA_MODULUS_BITS, /* NLA_U32 */ NCR_ATTR_RSA_E, /* NLA_BINARY */ NCR_ATTR_RSA_ENCODING_METHOD, /* NLA_U32 - ncr_rsa_type_t */ - NCR_ATTR_RSA_OAEP_HASH_ALGORITHM, /* NLA_U32 - ncr_algorithm_t */ + NCR_ATTR_RSA_OAEP_HASH_ALGORITHM, /* NLA_NUL_STRING */ NCR_ATTR_RSA_PSS_SALT_LENGTH, /* NLA_U32 */ NCR_ATTR_DSA_P_BITS, /* NLA_U32 */ NCR_ATTR_DSA_Q_BITS, /* NLA_U32 */ @@ -69,39 +68,6 @@ enum { #define NCR_CIPHER_MAX_BLOCK_LEN 32 #define NCR_HASH_MAX_OUTPUT_SIZE 64 -typedef enum { - NCR_ALG_NONE, - NCR_ALG_NULL, - NCR_ALG_3DES_CBC, - NCR_ALG_AES_CBC, - NCR_ALG_CAMELLIA_CBC, - NCR_ALG_ARCFOUR, - NCR_ALG_AES_ECB, - NCR_ALG_CAMELLIA_ECB, - NCR_ALG_AES_CTR, - NCR_ALG_CAMELLIA_CTR, - - NCR_ALG_SHA1=40, - NCR_ALG_MD5, - NCR_ALG_SHA2_224, - NCR_ALG_SHA2_256, - NCR_ALG_SHA2_384, - NCR_ALG_SHA2_512, - - NCR_ALG_HMAC_SHA1=80, - NCR_ALG_HMAC_MD5, - NCR_ALG_HMAC_SHA2_224, - NCR_ALG_HMAC_SHA2_256, - NCR_ALG_HMAC_SHA2_384, - NCR_ALG_HMAC_SHA2_512, - - NCR_ALG_RSA=140, - NCR_ALG_DSA, - NCR_ALG_DH, /* DH as in PKCS #3 */ -} ncr_algorithm_t; - - - typedef enum { NCR_WALG_AES_RFC3394, /* for secret keys only */ NCR_WALG_AES_RFC5649, /* can wrap arbitrary key */ diff --git a/utils.c b/utils.c index 8118a1d9e57..23d75f126d5 100644 --- a/utils.c +++ b/utils.c @@ -48,9 +48,9 @@ #endif /* !CONFIG_COMPAT */ static const struct nla_policy ncr_attr_policy[NCR_ATTR_MAX + 1] = { - [NCR_ATTR_ALGORITHM] = { NLA_U32, 0 }, + [NCR_ATTR_ALGORITHM] = { NLA_NUL_STRING, 0 }, [NCR_ATTR_DERIVATION_ALGORITHM] = { NLA_U32, 0 }, - [NCR_ATTR_SIGNATURE_HASH_ALGORITHM] = { NLA_U32, 0 }, + [NCR_ATTR_SIGNATURE_HASH_ALGORITHM] = { NLA_NUL_STRING, 0 }, [NCR_ATTR_WRAPPING_ALGORITHM] = { NLA_U32, 0 }, [NCR_ATTR_UPDATE_INPUT_DATA] = { NLA_BINARY, MAX_SESSION_INPUT_DATA_SIZE @@ -74,7 +74,7 @@ static const struct nla_policy ncr_attr_policy[NCR_ATTR_MAX + 1] = { [NCR_ATTR_RSA_MODULUS_BITS] = { NLA_U32, 0 }, [NCR_ATTR_RSA_E] = { NLA_BINARY, 0 }, [NCR_ATTR_RSA_ENCODING_METHOD] = { NLA_U32, 0 }, - [NCR_ATTR_RSA_OAEP_HASH_ALGORITHM] = { NLA_U32, 0 }, + [NCR_ATTR_RSA_OAEP_HASH_ALGORITHM] = { NLA_NUL_STRING, 0 }, [NCR_ATTR_RSA_PSS_SALT_LENGTH] = { NLA_U32, 0 }, [NCR_ATTR_DSA_P_BITS] = { NLA_U32, 0 }, [NCR_ATTR_DSA_Q_BITS] = { NLA_U32, 0 }, -- cgit