Skip to content

Commit 5adf46d

Browse files
krizhanovskykrizhanovsky
authored
Merge pull request #1173 from tempesta-tech/ak-1170
Fix #1170
2 parents c14a33b + 62ab90d commit 5adf46d

27 files changed

+1242
-1182
lines changed

‎linux-4.14.32.patch

Lines changed: 279 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -114,8 +114,63 @@ index f92a6593..d27c08f4 100644
114114
}
115115
EXPORT_SYMBOL_GPL(kernel_fpu_end);
116116

117+
diff --git a/crypto/aead.c b/crypto/aead.c
118+
index f794b30a..b6c3062b 100644
119+
--- a/crypto/aead.c
120+
+++ b/crypto/aead.c
121+
@@ -343,6 +343,22 @@ struct crypto_aead *crypto_alloc_aead(const char *alg_name, u32 type, u32 mask)
122+
}
123+
EXPORT_SYMBOL_GPL(crypto_alloc_aead);
124+
125+
+#ifdef CONFIG_SECURITY_TEMPESTA
126+
+struct crypto_alg *
127+
+crypto_find_aead(const char *alg_name, u32 type, u32 mask)
128+
+{
129+
+ return crypto_find_alg(alg_name, &crypto_aead_type, type, mask);
130+
+}
131+
+EXPORT_SYMBOL_GPL(crypto_find_aead);
132+
+
133+
+struct crypto_aead *
134+
+crypto_alloc_aead_atomic(struct crypto_alg *alg)
135+
+{
136+
+ return crypto_create_tfm(alg, &crypto_aead_type);
137+
+}
138+
+EXPORT_SYMBOL_GPL(crypto_alloc_aead_atomic);
139+
+#endif
140+
+
141+
static int aead_prepare_alg(struct aead_alg *alg)
142+
{
143+
struct crypto_alg *base = &alg->base;
144+
diff --git a/crypto/ahash.c b/crypto/ahash.c
145+
index f75b5c1f..9d659002 100644
146+
--- a/crypto/ahash.c
147+
+++ b/crypto/ahash.c
148+
@@ -559,6 +559,23 @@ struct crypto_ahash *crypto_alloc_ahash(const char *alg_name, u32 type,
149+
}
150+
EXPORT_SYMBOL_GPL(crypto_alloc_ahash);
151+
152+
+#ifdef CONFIG_SECURITY_TEMPESTA
153+
+/* Asynch hash is required by GHASH used in GCM. */
154+
+struct crypto_alg *
155+
+crypto_find_ahash(const char *alg_name, u32 type, u32 mask)
156+
+{
157+
+ return crypto_find_alg(alg_name, &crypto_ahash_type, type, mask);
158+
+}
159+
+EXPORT_SYMBOL_GPL(crypto_find_ahash);
160+
+
161+
+struct crypto_ahash *
162+
+crypto_alloc_ahash_atomic(struct crypto_alg *alg)
163+
+{
164+
+ return crypto_create_tfm(alg, &crypto_ahash_type);
165+
+}
166+
+EXPORT_SYMBOL_GPL(crypto_alloc_ahash_atomic);
167+
+#endif
168+
+
169+
int crypto_has_ahash(const char *alg_name, u32 type, u32 mask)
170+
{
171+
return crypto_type_has_alg(alg_name, &crypto_ahash_type, type, mask);
117172
diff --git a/crypto/api.c b/crypto/api.c
118-
index 941cd4c6..5fd308d8 100644
173+
index 941cd4c6..77dab1fd 100644
119174
--- a/crypto/api.c
120175
+++ b/crypto/api.c
121176
@@ -451,7 +451,11 @@ void *crypto_create_tfm(struct crypto_alg *alg,
@@ -130,6 +185,226 @@ index 941cd4c6..5fd308d8 100644
130185
if (mem == NULL)
131186
goto out_err;
132187

188+
@@ -487,6 +491,9 @@ struct crypto_alg *crypto_find_alg(const char *alg_name,
189+
struct crypto_alg *(*lookup)(const char *name, u32 type, u32 mask) =
190+
crypto_alg_mod_lookup;
191+
192+
+ /* The function is slow and preemptable to be called in softirq. */
193+
+ WARN_ON_ONCE(in_serving_softirq());
194+
+
195+
if (frontend) {
196+
type &= frontend->maskclear;
197+
mask &= frontend->maskclear;
198+
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
199+
index 248f6ba4..3fe4f2c1 100644
200+
--- a/crypto/cryptd.c
201+
+++ b/crypto/cryptd.c
202+
@@ -1217,12 +1217,29 @@ struct cryptd_skcipher *cryptd_alloc_skcipher(const char *alg_name,
203+
char cryptd_alg_name[CRYPTO_MAX_ALG_NAME];
204+
struct cryptd_skcipher_ctx *ctx;
205+
struct crypto_skcipher *tfm;
206+
-
207+
+#ifdef CONFIG_SECURITY_TEMPESTA
208+
+ static struct crypto_alg *alg = NULL;
209+
+
210+
+ if (unlikely(!alg)) {
211+
+ WARN_ON_ONCE(in_serving_softirq());
212+
+ if (snprintf(cryptd_alg_name, CRYPTO_MAX_ALG_NAME, "cryptd(%s)",
213+
+ alg_name)
214+
+ >= CRYPTO_MAX_ALG_NAME)
215+
+ {
216+
+ return ERR_PTR(-EINVAL);
217+
+ }
218+
+ alg = crypto_find_skcipher(cryptd_alg_name, type, mask);
219+
+ if (IS_ERR(alg))
220+
+ return (struct cryptd_skcipher *)alg;
221+
+ }
222+
+ tfm = crypto_alloc_skcipher_atomic(alg);
223+
+#else
224+
if (snprintf(cryptd_alg_name, CRYPTO_MAX_ALG_NAME,
225+
"cryptd(%s)", alg_name) >= CRYPTO_MAX_ALG_NAME)
226+
return ERR_PTR(-EINVAL);
227+
228+
tfm = crypto_alloc_skcipher(cryptd_alg_name, type, mask);
229+
+#endif
230+
if (IS_ERR(tfm))
231+
return ERR_CAST(tfm);
232+
233+
@@ -1269,11 +1286,28 @@ struct cryptd_ahash *cryptd_alloc_ahash(const char *alg_name,
234+
char cryptd_alg_name[CRYPTO_MAX_ALG_NAME];
235+
struct cryptd_hash_ctx *ctx;
236+
struct crypto_ahash *tfm;
237+
-
238+
+#ifdef CONFIG_SECURITY_TEMPESTA
239+
+ static struct crypto_alg *alg = NULL;
240+
+
241+
+ if (unlikely(!alg)) {
242+
+ WARN_ON_ONCE(in_serving_softirq());
243+
+ if (snprintf(cryptd_alg_name, CRYPTO_MAX_ALG_NAME, "cryptd(%s)",
244+
+ alg_name)
245+
+ >= CRYPTO_MAX_ALG_NAME)
246+
+ {
247+
+ return ERR_PTR(-EINVAL);
248+
+ }
249+
+ alg = crypto_find_ahash(cryptd_alg_name, type, mask);
250+
+ if (IS_ERR(alg))
251+
+ return (struct cryptd_ahash *)alg;
252+
+ }
253+
+ tfm = crypto_alloc_ahash_atomic(alg);
254+
+#else
255+
if (snprintf(cryptd_alg_name, CRYPTO_MAX_ALG_NAME,
256+
"cryptd(%s)", alg_name) >= CRYPTO_MAX_ALG_NAME)
257+
return ERR_PTR(-EINVAL);
258+
tfm = crypto_alloc_ahash(cryptd_alg_name, type, mask);
259+
+#endif
260+
if (IS_ERR(tfm))
261+
return ERR_CAST(tfm);
262+
if (tfm->base.__crt_alg->cra_module != THIS_MODULE) {
263+
@@ -1326,11 +1360,28 @@ struct cryptd_aead *cryptd_alloc_aead(const char *alg_name,
264+
char cryptd_alg_name[CRYPTO_MAX_ALG_NAME];
265+
struct cryptd_aead_ctx *ctx;
266+
struct crypto_aead *tfm;
267+
-
268+
+#ifdef CONFIG_SECURITY_TEMPESTA
269+
+ static struct crypto_alg *alg = NULL;
270+
+
271+
+ if (unlikely(!alg)) {
272+
+ WARN_ON_ONCE(in_serving_softirq());
273+
+ if (snprintf(cryptd_alg_name, CRYPTO_MAX_ALG_NAME, "cryptd(%s)",
274+
+ alg_name)
275+
+ >= CRYPTO_MAX_ALG_NAME)
276+
+ {
277+
+ return ERR_PTR(-EINVAL);
278+
+ }
279+
+ alg = crypto_find_aead(cryptd_alg_name, type, mask);
280+
+ if (IS_ERR(alg))
281+
+ return (struct cryptd_aead *)alg;
282+
+ }
283+
+ tfm = crypto_alloc_aead_atomic(alg);
284+
+#else
285+
if (snprintf(cryptd_alg_name, CRYPTO_MAX_ALG_NAME,
286+
"cryptd(%s)", alg_name) >= CRYPTO_MAX_ALG_NAME)
287+
return ERR_PTR(-EINVAL);
288+
tfm = crypto_alloc_aead(cryptd_alg_name, type, mask);
289+
+#endif
290+
if (IS_ERR(tfm))
291+
return ERR_CAST(tfm);
292+
if (tfm->base.__crt_alg->cra_module != THIS_MODULE) {
293+
diff --git a/crypto/shash.c b/crypto/shash.c
294+
index 5d732c6b..f3f35aba 100644
295+
--- a/crypto/shash.c
296+
+++ b/crypto/shash.c
297+
@@ -454,6 +454,22 @@ struct crypto_shash *crypto_alloc_shash(const char *alg_name, u32 type,
298+
}
299+
EXPORT_SYMBOL_GPL(crypto_alloc_shash);
300+
301+
+#ifdef CONFIG_SECURITY_TEMPESTA
302+
+struct crypto_alg *
303+
+crypto_find_shash(const char *alg_name, u32 type, u32 mask)
304+
+{
305+
+ return crypto_find_alg(alg_name, &crypto_shash_type, type, mask);
306+
+}
307+
+EXPORT_SYMBOL_GPL(crypto_find_shash);
308+
+
309+
+struct crypto_shash *
310+
+crypto_alloc_shash_atomic(struct crypto_alg *alg)
311+
+{
312+
+ return crypto_create_tfm(alg, &crypto_shash_type);
313+
+}
314+
+EXPORT_SYMBOL_GPL(crypto_alloc_shash_atomic);
315+
+#endif
316+
+
317+
static int shash_prepare_alg(struct shash_alg *alg)
318+
{
319+
struct crypto_alg *base = &alg->base;
320+
diff --git a/crypto/skcipher.c b/crypto/skcipher.c
321+
index 11af5fd6..f45933b6 100644
322+
--- a/crypto/skcipher.c
323+
+++ b/crypto/skcipher.c
324+
@@ -928,6 +928,22 @@ struct crypto_skcipher *crypto_alloc_skcipher(const char *alg_name,
325+
}
326+
EXPORT_SYMBOL_GPL(crypto_alloc_skcipher);
327+
328+
+#ifdef CONFIG_SECURITY_TEMPESTA
329+
+struct crypto_alg *
330+
+crypto_find_skcipher(const char *alg_name, u32 type, u32 mask)
331+
+{
332+
+ return crypto_find_alg(alg_name, &crypto_skcipher_type2, type, mask);
333+
+}
334+
+EXPORT_SYMBOL_GPL(crypto_find_skcipher);
335+
+
336+
+struct crypto_skcipher *
337+
+crypto_alloc_skcipher_atomic(struct crypto_alg *alg)
338+
+{
339+
+ return crypto_create_tfm(alg, &crypto_skcipher_type2);
340+
+}
341+
+EXPORT_SYMBOL_GPL(crypto_alloc_skcipher_atomic);
342+
+#endif
343+
+
344+
int crypto_has_skcipher2(const char *alg_name, u32 type, u32 mask)
345+
{
346+
return crypto_type_has_alg(alg_name, &crypto_skcipher_type2,
347+
diff --git a/include/crypto/aead.h b/include/crypto/aead.h
348+
index 03b97629..1089ee66 100644
349+
--- a/include/crypto/aead.h
350+
+++ b/include/crypto/aead.h
351+
@@ -179,6 +179,11 @@ static inline struct crypto_aead *__crypto_aead_cast(struct crypto_tfm *tfm)
352+
*/
353+
struct crypto_aead *crypto_alloc_aead(const char *alg_name, u32 type, u32 mask);
354+
355+
+#ifdef CONFIG_SECURITY_TEMPESTA
356+
+struct crypto_alg *crypto_find_aead(const char *alg_name, u32 type, u32 mask);
357+
+struct crypto_aead *crypto_alloc_aead_atomic(struct crypto_alg *alg);
358+
+#endif
359+
+
360+
static inline struct crypto_tfm *crypto_aead_tfm(struct crypto_aead *tfm)
361+
{
362+
return &tfm->base;
363+
diff --git a/include/crypto/hash.h b/include/crypto/hash.h
364+
index 74827781..6fc97be4 100644
365+
--- a/include/crypto/hash.h
366+
+++ b/include/crypto/hash.h
367+
@@ -245,6 +245,11 @@ static inline struct crypto_ahash *__crypto_ahash_cast(struct crypto_tfm *tfm)
368+
struct crypto_ahash *crypto_alloc_ahash(const char *alg_name, u32 type,
369+
u32 mask);
370+
371+
+#ifdef CONFIG_SECURITY_TEMPESTA
372+
+struct crypto_alg *crypto_find_ahash(const char *alg_name, u32 type, u32 mask);
373+
+struct crypto_ahash *crypto_alloc_ahash_atomic(struct crypto_alg *alg);
374+
+#endif
375+
+
376+
static inline struct crypto_tfm *crypto_ahash_tfm(struct crypto_ahash *tfm)
377+
{
378+
return &tfm->base;
379+
@@ -681,6 +686,11 @@ static inline void ahash_request_set_crypt(struct ahash_request *req,
380+
struct crypto_shash *crypto_alloc_shash(const char *alg_name, u32 type,
381+
u32 mask);
382+
383+
+#ifdef CONFIG_SECURITY_TEMPESTA
384+
+struct crypto_alg *crypto_find_shash(const char *alg_name, u32 type, u32 mask);
385+
+struct crypto_shash *crypto_alloc_shash_atomic(struct crypto_alg *alg);
386+
+#endif
387+
+
388+
static inline struct crypto_tfm *crypto_shash_tfm(struct crypto_shash *tfm)
389+
{
390+
return &tfm->base;
391+
diff --git a/include/crypto/skcipher.h b/include/crypto/skcipher.h
392+
index 562001cb..b99ea7bb 100644
393+
--- a/include/crypto/skcipher.h
394+
+++ b/include/crypto/skcipher.h
395+
@@ -197,6 +197,12 @@ static inline struct crypto_skcipher *__crypto_skcipher_cast(
396+
struct crypto_skcipher *crypto_alloc_skcipher(const char *alg_name,
397+
u32 type, u32 mask);
398+
399+
+#ifdef CONFIG_SECURITY_TEMPESTA
400+
+struct crypto_alg *crypto_find_skcipher(const char *alg_name, u32 type,
401+
+ u32 mask);
402+
+struct crypto_skcipher *crypto_alloc_skcipher_atomic(struct crypto_alg *alg);
403+
+#endif
404+
+
405+
static inline struct crypto_tfm *crypto_skcipher_tfm(
406+
struct crypto_skcipher *tfm)
407+
{
133408
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
134409
index 69c23821..58486beb 100644
135410
--- a/include/linux/interrupt.h
@@ -469,18 +744,17 @@ index d323d4fa..0f6bd0cf 100644
469744
}
470745

471746
diff --git a/include/net/tls.h b/include/net/tls.h
472-
index df950383..4a99f03d 100644
747+
index df950383..c3d45c5e 100644
473748
--- a/include/net/tls.h
474749
+++ b/include/net/tls.h
475-
@@ -55,6 +55,13 @@
750+
@@ -55,6 +55,12 @@
476751

477752
#define TLS_AAD_SPACE_SIZE 13
478753

479754
+#ifdef CONFIG_SECURITY_TEMPESTA
480755
+#define TLS_MAX_TAG_SZ 16
481756
+/* Maximum size for required skb overhead: header, IV, tag. */
482-
+#define TLS_MAX_OVERHEAD (TLS_HEADER_SIZE + TLS_AAD_SPACE_SIZE \
483-
+ + TLS_MAX_TAG_SZ)
757+
+#define TLS_MAX_OVERHEAD (TLS_AAD_SPACE_SIZE + TLS_MAX_TAG_SZ)
484758
+#endif
485759
+
486760
struct tls_sw_context {

‎tempesta_fw/tls.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,8 @@ tfw_tls_encrypt(struct sock *sk, struct sk_buff *skb, unsigned int limit)
250250
tcb->seq, tcb->end_seq);
251251
BUG_ON(!ttls_xfrm_ready(tls));
252252
WARN_ON_ONCE(skb->len > TLS_MAX_PAYLOAD_SIZE);
253-
WARN_ON_ONCE(tcb->seq + skb->len != tcb->end_seq);
253+
WARN_ON_ONCE(tcb->seq + skb->len + !!(tcb->tcp_flags & TCPHDR_FIN)
254+
!= tcb->end_seq);
254255

255256
head_sz = ttls_payload_off(xfrm);
256257
tag_sz = ttls_xfrm_taglen(xfrm);

‎tls/bignum.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2169,7 +2169,7 @@ ttls_mpi_modexit(void)
21692169
}
21702170
}
21712171

2172-
int
2172+
int __init
21732173
ttls_mpi_modinit(void)
21742174
{
21752175
int cpu;

0 commit comments

Comments
 (0)