crypto: restrict usage of helper ciphers
Subsystems (5)
v2 cover crypto: restrict usage of helper ciphers
Hi,
Based on the discussion in the thread [1], a flag is added to the kernel crypto API to allow ciphers to be marked as internal.
The patch set is tested in FIPS and non-FIPS mode. In addition, the enforcement that the helper cipher of __driver-gcm-aes-aesni cannot be loaded, but the wrapper of rfc4106-gcm-aesni can be used is tested to demonstrate that the patch works. The testing also shows that of__driver-gcm-aes-aesni is subject to the testmgr self test an can therefore be used in FIPS mode.
All cipher implementation whose definition has a cra_priority of 0 as well as the ciphers that are wrapped by cryptd and mcryptd are marked as internal ciphers to prevent them from being called by users.
The testing also includes the invocation of normal crypto operations from user space via AF_ALG and libkcapi showing that all of them work unaffected.
[1] http://comments.gmane.org/gmane.linux.kernel.cryptoapi/13705
Changes v2:
* Overhaul enforcement of the internal flag as suggested by Herbert:
a cipher marked as internal can only be invoked if the caller instantiates it with the internal flag set in the type and mask field.
* The overhaul implies that cryptd and mcryptd instances are marked as internal if the underlying cipher is marked as internal.
* The overhaul implies that the testmgr must try to allocate a cipher again with the internal flag in case the first allocation failed with -ENOENT.
* Mark internal cipher in arch/x86/crypto/sha-mb/sha1_mb.c.
Stephan Mueller (20):
crypto: prevent helper ciphers from being used
crypto: testmgr to use CRYPTO_ALG_INTERNAL
crypto: cryptd to process CRYPTO_ALG_INTERNAL
crypto: /proc/crypto: identify internal ciphers
crypto: mark AES-NI helper ciphers
crypto: mark ghash clmulni helper ciphers
crypto: mark GHASH ARMv8 vmull.p64 helper ciphers
crypto: mark AES-NI Camellia helper ciphers
crypto: mark CAST5 helper ciphers
crypto: mark AVX Camellia helper ciphers
crypto: mark CAST6 helper ciphers
crypto: mark Serpent AVX2 helper ciphers
crypto: mark Serpent AVX helper ciphers
crypto: mark Serpent SSE2 helper ciphers
crypto: mark Twofish AVX helper ciphers
crypto: mark NEON bit sliced AES helper ciphers
crypto: mark ARMv8 AES helper ciphers
crypto: mark 64 bit ARMv8 AES helper ciphers
crypto: mcryptd to process CRYPTO_ALG_INTERNAL
crypto: mark Multi buffer SHA1 helper cipher
arch/arm/crypto/aes-ce-glue.c | 12 +++++--- arch/arm/crypto/aesbs-glue.c | 9 ++++-- arch/arm/crypto/ghash-ce-glue.c | 6 ++-- arch/arm64/crypto/aes-glue.c | 12 +++++--- arch/x86/crypto/aesni-intel_glue.c | 23 +++++++++----- arch/x86/crypto/camellia_aesni_avx2_glue.c | 15 ++++++--- arch/x86/crypto/camellia_aesni_avx_glue.c | 15 ++++++--- arch/x86/crypto/cast5_avx_glue.c | 9 ++++-- arch/x86/crypto/cast6_avx_glue.c | 15 ++++++--- arch/x86/crypto/ghash-clmulni-intel_glue.c | 7 +++-- arch/x86/crypto/serpent_avx2_glue.c | 15 ++++++--- arch/x86/crypto/serpent_avx_glue.c | 15 ++++++--- arch/x86/crypto/serpent_sse2_glue.c | 15 ++++++--- arch/x86/crypto/sha-mb/sha1_mb.c | 7 +++-- arch/x86/crypto/twofish_avx_glue.c | 15 ++++++--- crypto/ablk_helper.c | 3 +- crypto/api.c | 6 ++++ crypto/cryptd.c | 49 +++++++++++++++++++++++++----- crypto/mcryptd.c | 25 +++++++++++++-- crypto/proc.c | 3 ++ crypto/testmgr.c | 22 ++++++++++++++ include/linux/crypto.h | 6 ++++ 22 files changed, 230 insertions(+), 74 deletions(-)
Signature · 1 line
2.1.0
PATCH v2 1/20 crypto: prevent helper ciphers from being used
Several hardware related cipher implementations are implemented as
follows: a "helper" cipher implementation is registered with the kernel crypto API.
Such helper ciphers are never intended to be called by normal users. In some cases, calling them via the normal crypto API may even cause failures including kernel crashes. In a normal case, the "wrapping" ciphers that use the helpers ensure that these helpers are invoked such that they cannot cause any calamity.
Considering the AF_ALG user space interface, unprivileged users can call all ciphers registered with the crypto API, including these helper ciphers that are not intended to be called directly. That means, with AF_ALG user space may invoke these helper ciphers and may cause undefined states or side effects.
To avoid any potential side effects with such helpers, the patch prevents the helpers to be called directly. A new cipher type flag is added: CRYPTO_ALG_INTERNAL. This flag shall be used to mark helper ciphers. These ciphers can only be used if the caller invoke the cipher with CRYPTO_ALG_INTERNAL in the type and mask field.
Signed-off-by Stephan Mueller <[email protected]>
--- crypto/api.c | 6 ++++++ include/linux/crypto.h | 6 ++++++ 2 files changed, 12 insertions(+)
crypto/api.c +6 -0
@@ -257,6 +257,12 @@ struct crypto_alg *crypto_alg_mod_lookup(const char *name, u32 type, u32 mask) mask |=CRYPTO_ALG_TESTED ; } +/* +* If the internal flag is set for a cipher, require a caller to +* to invoke the cipher with the internal flag to use that cipher. +*/ + mask |=CRYPTO_ALG_INTERNAL ; + larval =crypto_larval_lookup (name, type, mask);if (IS_ERR (larval) || !crypto_is_larval (larval))return larval;
include/linux/crypto.h +6 -0
@@ -95,6 +95,12 @@#define CRYPTO_ALG_KERN_DRIVER_ONLY 0x00001000/* +* Mark a cipher as a service implementation only usable by another +* cipher and never by a normal user of the kernel crypto API +*/ +#define CRYPTO_ALG_INTERNAL 0x00002000 + +/* * Transform masks and values (for crt_flags). */ #define CRYPTO_TFM_REQ_MASK 0x000fff00
Signature · 1 line
2.1.0
PATCH v2 2/20 crypto: testmgr to use CRYPTO_ALG_INTERNAL
In reply to Stephan MuellerIf a cipher allocation fails with -ENOENT, the testmgr now retries to allocate the cipher with CRYPTO_ALG_INTERNAL flag.
As all ciphers, including the internal ciphers will be processed by the testmgr, it needs to be able to allocate those ciphers.
Signed-off-by Stephan Mueller <[email protected]>
--- crypto/testmgr.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
crypto/testmgr.c +22 -0
@@ -1506,6 +1506,9 @@ static int alg_test_aead(const struct alg_test_desc *desc, const char *driver,int err =0 ; tfm =crypto_alloc_aead (driver, type, mask); +if (PTR_ERR (tfm) == -ENOENT ) + tfm =crypto_alloc_aead (driver, type |CRYPTO_ALG_INTERNAL , + mask |CRYPTO_ALG_INTERNAL );if (IS_ERR (tfm)) {printk (KERN_ERR "alg: aead: Failed to load transform for %s: " "%ld\n" , driver,PTR_ERR (tfm));
@@ -1535,6 +1538,9 @@ static int alg_test_cipher(const struct alg_test_desc *desc,int err =0 ; tfm =crypto_alloc_cipher (driver, type, mask); +if (PTR_ERR (tfm) == -ENOENT ) + tfm =crypto_alloc_cipher (driver, type |CRYPTO_ALG_INTERNAL , + mask |CRYPTO_ALG_INTERNAL );if (IS_ERR (tfm)) {printk (KERN_ERR "alg: cipher: Failed to load transform for " "%s: %ld\n" , driver,PTR_ERR (tfm));
@@ -1564,6 +1570,10 @@ static int alg_test_skcipher(const struct alg_test_desc *desc,int err =0 ; tfm =crypto_alloc_ablkcipher (driver, type, mask); +if (PTR_ERR (tfm) == -ENOENT ) + tfm =crypto_alloc_ablkcipher (driver, + type |CRYPTO_ALG_INTERNAL , + mask |CRYPTO_ALG_INTERNAL );if (IS_ERR (tfm)) {printk (KERN_ERR "alg: skcipher: Failed to load transform for " "%s: %ld\n" , driver,PTR_ERR (tfm));
@@ -1637,6 +1647,9 @@ static int alg_test_hash(const struct alg_test_desc *desc, const char *driver,int err; tfm =crypto_alloc_ahash (driver, type, mask); +if (PTR_ERR (tfm) == -ENOENT ) + tfm =crypto_alloc_ahash (driver, type |CRYPTO_ALG_INTERNAL , + mask |CRYPTO_ALG_INTERNAL );if (IS_ERR (tfm)) {printk (KERN_ERR "alg: hash: Failed to load transform for %s: " "%ld\n" , driver,PTR_ERR (tfm));
@@ -1665,6 +1678,9 @@ static int alg_test_crc32c(const struct alg_test_desc *desc, goto out; tfm =crypto_alloc_shash (driver, type, mask); +if (PTR_ERR (tfm) == -ENOENT ) + tfm =crypto_alloc_shash (driver, type |CRYPTO_ALG_INTERNAL , + mask |CRYPTO_ALG_INTERNAL );if (IS_ERR (tfm)) {printk (KERN_ERR "alg: crc32c: Failed to load transform for %s: " "%ld\n" , driver,PTR_ERR (tfm));
@@ -1707,6 +1723,9 @@ static int alg_test_cprng(const struct alg_test_desc *desc, const char *driver,int err; rng =crypto_alloc_rng (driver, type, mask); +if (PTR_ERR (rng) == -ENOENT ) + rng =crypto_alloc_rng (driver, type |CRYPTO_ALG_INTERNAL , + mask |CRYPTO_ALG_INTERNAL );if (IS_ERR (rng)) {printk (KERN_ERR "alg: cprng: Failed to load transform for %s: " "%ld\n" , driver,PTR_ERR (rng));
@@ -1734,6 +1753,9 @@ static int drbg_cavs_test(struct drbg_testvec *test, int pr,return -ENOMEM ; drng =crypto_alloc_rng (driver, type, mask); +if (PTR_ERR (drng) == -ENOENT ) + drng =crypto_alloc_rng (driver, type |CRYPTO_ALG_INTERNAL , + mask |CRYPTO_ALG_INTERNAL );if (IS_ERR (drng)) {printk (KERN_ERR "alg: drbg: could not allocate DRNG handle for " "%s\n" , driver);
Signature · 1 line
2.1.0
Herbert Xu
maintainerRe: [PATCH v2 02/20] crypto: testmgr to use CRYPTO_ALG_INTERNAL
Quoted 16 lines · Stephan Mueller
If a cipher allocation fails with
-ENOENT, the testmgr now retries to allocate the cipher withCRYPTO_ALG_INTERNALflag.As all ciphers, including the internal ciphers will be processed by the testmgr, it needs to be able to allocate those ciphers.
Signed-off-by Stephan Mueller <[email protected]>--- crypto/testmgr.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)crypto/testmgr.c +0
-0
crypto/testmgr.c static int alg_test_aead(const struct alg_test_desc *desc, const char *driver, · line 1511
Quoted 6 lines
crypto/testmgr.c +3
-0@@ -1506,6 +1506,9 @@ static int alg_test_aead(const struct alg_test_desc *desc, const char *driver,int err =0 ; tfm =crypto_alloc_aead (driver, type, mask); +if (PTR_ERR (tfm) == -ENOENT ) + tfm =crypto_alloc_aead (driver, type |CRYPTO_ALG_INTERNAL , + mask |CRYPTO_ALG_INTERNAL );
We need to be able to say give me an algorithm regardless of the INTERNAL bit. How about treating (type & CRYPTO_ALG_INTERNAL) && !(mask & CRYPTO_ALG_INTERNAL) as that special case?
So in patch 1 you would do
if (!((type | mask) & CRYPTO_ALG_INTERNAL)) mask |= CRYPTO_ALG_INTERNAL;
Thanks,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Re: [PATCH v2 02/20] crypto: testmgr to use CRYPTO_ALG_INTERNAL
Am Dienstag, 31. März 2015, 00:10:34 schrieb Herbert Xu:
Hi Herbert,
Quoted 31 lines · Stephan Mueller
Quoted 17 lines
If a cipher allocation fails with
-ENOENT, the testmgr now retries to allocate the cipher withCRYPTO_ALG_INTERNALflag.As all ciphers, including the internal ciphers will be processed by the testmgr, it needs to be able to allocate those ciphers.
Signed-off-by Stephan Mueller <[email protected]>---
crypto/testmgr.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)crypto/testmgr.c +0
-0crypto/testmgr.c static int alg_test_aead(const struct alg_test_desc · line 1513
Quoted 8 lines
crypto/testmgr.c +3
-0@@ -1506,6 +1506,9 @@ static int alg_test_aead(const struct alg_test_desc *desc, const char *driver,>int err =0 ; tfm =crypto_alloc_aead (driver, type, mask); +if (PTR_ERR (tfm) == -ENOENT ) + tfm =crypto_alloc_aead (driver, type |CRYPTO_ALG_INTERNAL , + mask |CRYPTO_ALG_INTERNAL );We need to be able to say give me an algorithm regardless of the INTERNAL bit. How about treating (type &
CRYPTO_ALG_INTERNAL) && !(mask &CRYPTO_ALG_INTERNAL) as that special case?
Quoted 4 lines
So in patch 1 you would do
if (!((type | mask) & CRYPTO_ALG_INTERNAL)) mask |= CRYPTO_ALG_INTERNAL;
Thank you for the hint. It works and I will release a patch shortly.
Quoted 2 lines
Thanks,
Signature · 2 lines
Ciao Stephan
PATCH v2 3/20 crypto: cryptd to process CRYPTO_ALG_INTERNAL
In reply to Stephan MuellerThe cryptd is used as a wrapper around internal ciphers. Therefore, the cryptd must process the internal cipher by marking cryptd as internal if the underlying cipher is an internal cipher.
Signed-off-by Stephan Mueller <[email protected]>
--- crypto/ablk_helper.c | 3 ++- crypto/cryptd.c | 49 +++++++++++++++++++++++++++++++++++++++++-------- 2 files changed, 43 insertions(+), 9 deletions(-)
crypto/ablk_helper.c +2 -1
@@ -124,7 +124,8 @@ int ablk_init_common(struct crypto_tfm *tfm, const char *drv_name)struct async_helper_ctx *ctx =crypto_tfm_ctx (tfm);struct cryptd_ablkcipher *cryptd_tfm; - cryptd_tfm =cryptd_alloc_ablkcipher (drv_name,0 ,0 ); + cryptd_tfm =cryptd_alloc_ablkcipher (drv_name,CRYPTO_ALG_INTERNAL , +CRYPTO_ALG_INTERNAL );if (IS_ERR (cryptd_tfm))return PTR_ERR (cryptd_tfm);
crypto/cryptd.c +41 -8
97 lines not on this page · raw message
Signature · 1 line
2.1.0
PATCH v2 4/20 crypto: /proc/crypto: identify internal ciphers
In reply to Stephan MuellerWith ciphers that now cannot be accessed via the kernel crypto API, callers shall be able to identify the ciphers that are not callable. The /proc/crypto file is added a boolean field identifying that such internal ciphers.
Signed-off-by Stephan Mueller <[email protected]>
--- crypto/proc.c | 3 +++ 1 file changed, 3 insertions(+)
crypto/proc.c +3 -0
@@ -89,6 +89,9 @@ static int c_show(struct seq_file *m, void *p)seq_printf (m,"selftest : %s\n" , (alg->cra_flags &CRYPTO_ALG_TESTED ) ?"passed" :"unknown" ); +seq_printf (m,"internal : %s\n" , + (alg->cra_flags &CRYPTO_ALG_INTERNAL ) ? +"yes" :"no" );if (alg->cra_flags &CRYPTO_ALG_LARVAL ) {seq_printf (m,"type : larval\n" );
Signature · 1 line
2.1.0
PATCH v2 5/20 crypto: mark AES-NI helper ciphers
In reply to Stephan MuellerFlag all AES-NI helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/aesni-intel_glue.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
arch/x86/crypto/aesni-intel_glue.c +15 -8
@@ -797,7 +797,9 @@ static int rfc4106_init(struct crypto_tfm *tfm)PTR_ALIGN ((u8 *)crypto_tfm_ctx (tfm),AESNI_ALIGN );struct crypto_aead *cryptd_child;struct aesni_rfc4106_gcm_ctx *child_ctx; - cryptd_tfm =cryptd_alloc_aead ("__driver-gcm-aes-aesni" ,0 ,0 ); + cryptd_tfm =cryptd_alloc_aead ("__driver-gcm-aes-aesni" , +CRYPTO_ALG_INTERNAL , +CRYPTO_ALG_INTERNAL );if (IS_ERR (cryptd_tfm))return PTR_ERR (cryptd_tfm);
@@ -1262,7 +1264,7 @@ static struct crypto_alg aesni_algs[] = { { .cra_name = "__aes-aesni", .cra_driver_name = "__driver-aes-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_CIPHER, + .cra_flags = CRYPTO_ALG_TYPE_CIPHER | CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize =sizeof (struct crypto_aes_ctx ) + AESNI_ALIGN - 1,
@@ -1281,7 +1283,8 @@ static struct crypto_alg aesni_algs[] = { { .cra_name = "__ecb-aes-aesni", .cra_driver_name = "__driver-ecb-aes-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize =sizeof (struct crypto_aes_ctx ) + AESNI_ALIGN - 1,
@@ -1301,7 +1304,8 @@ static struct crypto_alg aesni_algs[] = { { .cra_name = "__cbc-aes-aesni", .cra_driver_name = "__driver-cbc-aes-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize =sizeof (struct crypto_aes_ctx ) + AESNI_ALIGN - 1,
@@ -1365,7 +1369,8 @@ static struct crypto_alg aesni_algs[] = { { .cra_name = "__ctr-aes-aesni", .cra_driver_name = "__driver-ctr-aes-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize =sizeof (struct crypto_aes_ctx ) + AESNI_ALIGN - 1,
@@ -1409,7 +1414,7 @@ static struct crypto_alg aesni_algs[] = { { .cra_name = "__gcm-aes-aesni", .cra_driver_name = "__driver-gcm-aes-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_AEAD, + .cra_flags = CRYPTO_ALG_TYPE_AEAD | CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize =sizeof (struct aesni_rfc4106_gcm_ctx ) + AESNI_ALIGN,
@@ -1479,7 +1484,8 @@ static struct crypto_alg aesni_algs[] = { { .cra_name = "__lrw-aes-aesni", .cra_driver_name = "__driver-lrw-aes-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct aesni_lrw_ctx), .cra_alignmask = 0,
@@ -1500,7 +1506,8 @@ static struct crypto_alg aesni_algs[] = { { .cra_name = "__xts-aes-aesni", .cra_driver_name = "__driver-xts-aes-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct aesni_xts_ctx), .cra_alignmask = 0,
Signature · 1 line
2.1.0
PATCH v2 6/20 crypto: mark ghash clmulni helper ciphers
In reply to Stephan MuellerFlag all ash clmulni helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/ghash-clmulni-intel_glue.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/x86/crypto/ghash-clmulni-intel_glue.c +5 -2
@@ -154,7 +154,8 @@ static struct shash_alg ghash_alg = { .cra_name = "__ghash", .cra_driver_name = "__ghash-pclmulqdqni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_SHASH, + .cra_flags =CRYPTO_ALG_TYPE_SHASH | + CRYPTO_ALG_INTERNAL, .cra_blocksize = GHASH_BLOCK_SIZE, .cra_ctxsize = sizeof(struct ghash_ctx), .cra_module = THIS_MODULE,
@@ -261,7 +262,9 @@ static int ghash_async_init_tfm(struct crypto_tfm *tfm)struct cryptd_ahash *cryptd_tfm;struct ghash_async_ctx *ctx =crypto_tfm_ctx (tfm); - cryptd_tfm =cryptd_alloc_ahash ("__ghash-pclmulqdqni" ,0 ,0 ); + cryptd_tfm =cryptd_alloc_ahash ("__ghash-pclmulqdqni" , +CRYPTO_ALG_INTERNAL , +CRYPTO_ALG_INTERNAL );if (IS_ERR (cryptd_tfm))return PTR_ERR (cryptd_tfm); ctx->cryptd_tfm = cryptd_tfm;
Signature · 1 line
2.1.0
PATCH v2 7/20 crypto: mark GHASH ARMv8 vmull.p64 helper ciphers
In reply to Stephan MuellerFlag all GHASH ARMv8 vmull.p64 helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/arm/crypto/ghash-ce-glue.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/arm/crypto/ghash-ce-glue.c +4 -2
@@ -141,7 +141,7 @@ static struct shash_alg ghash_alg = { .cra_name = "ghash", .cra_driver_name = "__driver-ghash-ce", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_SHASH, + .cra_flags = CRYPTO_ALG_TYPE_SHASH | CRYPTO_ALG_INTERNAL, .cra_blocksize = GHASH_BLOCK_SIZE, .cra_ctxsize = sizeof(struct ghash_key), .cra_module = THIS_MODULE,
@@ -248,7 +248,9 @@ static int ghash_async_init_tfm(struct crypto_tfm *tfm)struct cryptd_ahash *cryptd_tfm;struct ghash_async_ctx *ctx =crypto_tfm_ctx (tfm); - cryptd_tfm =cryptd_alloc_ahash ("__driver-ghash-ce" ,0 ,0 ); + cryptd_tfm =cryptd_alloc_ahash ("__driver-ghash-ce" , +CRYPTO_ALG_INTERNAL , +CRYPTO_ALG_INTERNAL );if (IS_ERR (cryptd_tfm))return PTR_ERR (cryptd_tfm); ctx->cryptd_tfm = cryptd_tfm;
Signature · 1 line
2.1.0
PATCH v2 8/20 crypto: mark AES-NI Camellia helper ciphers
In reply to Stephan MuellerFlag all AES-NI Camellia helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/camellia_aesni_avx2_glue.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/crypto/camellia_aesni_avx2_glue.c +10 -5
@@ -343,7 +343,8 @@ static struct crypto_alg cmll_algs[10] = { { .cra_name = "__ecb-camellia-aesni-avx2", .cra_driver_name = "__driver-ecb-camellia-aesni-avx2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAMELLIA_BLOCK_SIZE, .cra_ctxsize = sizeof(struct camellia_ctx), .cra_alignmask = 0,
@@ -362,7 +363,8 @@ static struct crypto_alg cmll_algs[10] = { { .cra_name = "__cbc-camellia-aesni-avx2", .cra_driver_name = "__driver-cbc-camellia-aesni-avx2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAMELLIA_BLOCK_SIZE, .cra_ctxsize = sizeof(struct camellia_ctx), .cra_alignmask = 0,
@@ -381,7 +383,8 @@ static struct crypto_alg cmll_algs[10] = { { .cra_name = "__ctr-camellia-aesni-avx2", .cra_driver_name = "__driver-ctr-camellia-aesni-avx2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct camellia_ctx), .cra_alignmask = 0,
@@ -401,7 +404,8 @@ static struct crypto_alg cmll_algs[10] = { { .cra_name = "__lrw-camellia-aesni-avx2", .cra_driver_name = "__driver-lrw-camellia-aesni-avx2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAMELLIA_BLOCK_SIZE, .cra_ctxsize = sizeof(struct camellia_lrw_ctx), .cra_alignmask = 0,
@@ -424,7 +428,8 @@ static struct crypto_alg cmll_algs[10] = { { .cra_name = "__xts-camellia-aesni-avx2", .cra_driver_name = "__driver-xts-camellia-aesni-avx2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAMELLIA_BLOCK_SIZE, .cra_ctxsize = sizeof(struct camellia_xts_ctx), .cra_alignmask = 0,
Signature · 1 line
2.1.0
PATCH v2 9/20 crypto: mark CAST5 helper ciphers
In reply to Stephan MuellerFlag all CAST5 helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/cast5_avx_glue.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
arch/x86/crypto/cast5_avx_glue.c +6 -3
@@ -341,7 +341,8 @@ static struct crypto_alg cast5_algs[6] = { { .cra_name = "__ecb-cast5-avx", .cra_driver_name = "__driver-ecb-cast5-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAST5_BLOCK_SIZE, .cra_ctxsize = sizeof(struct cast5_ctx), .cra_alignmask = 0,
@@ -360,7 +361,8 @@ static struct crypto_alg cast5_algs[6] = { { .cra_name = "__cbc-cast5-avx", .cra_driver_name = "__driver-cbc-cast5-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAST5_BLOCK_SIZE, .cra_ctxsize = sizeof(struct cast5_ctx), .cra_alignmask = 0,
@@ -379,7 +381,8 @@ static struct crypto_alg cast5_algs[6] = { { .cra_name = "__ctr-cast5-avx", .cra_driver_name = "__driver-ctr-cast5-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct cast5_ctx), .cra_alignmask = 0,
Signature · 1 line
2.1.0
PATCH v2 10/20 crypto: mark AVX Camellia helper ciphers
In reply to Stephan MuellerFlag all AVX Camellia helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/camellia_aesni_avx_glue.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/crypto/camellia_aesni_avx_glue.c +10 -5
@@ -335,7 +335,8 @@ static struct crypto_alg cmll_algs[10] = { { .cra_name = "__ecb-camellia-aesni", .cra_driver_name = "__driver-ecb-camellia-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAMELLIA_BLOCK_SIZE, .cra_ctxsize = sizeof(struct camellia_ctx), .cra_alignmask = 0,
@@ -354,7 +355,8 @@ static struct crypto_alg cmll_algs[10] = { { .cra_name = "__cbc-camellia-aesni", .cra_driver_name = "__driver-cbc-camellia-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAMELLIA_BLOCK_SIZE, .cra_ctxsize = sizeof(struct camellia_ctx), .cra_alignmask = 0,
@@ -373,7 +375,8 @@ static struct crypto_alg cmll_algs[10] = { { .cra_name = "__ctr-camellia-aesni", .cra_driver_name = "__driver-ctr-camellia-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct camellia_ctx), .cra_alignmask = 0,
@@ -393,7 +396,8 @@ static struct crypto_alg cmll_algs[10] = { { .cra_name = "__lrw-camellia-aesni", .cra_driver_name = "__driver-lrw-camellia-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAMELLIA_BLOCK_SIZE, .cra_ctxsize = sizeof(struct camellia_lrw_ctx), .cra_alignmask = 0,
@@ -416,7 +420,8 @@ static struct crypto_alg cmll_algs[10] = { { .cra_name = "__xts-camellia-aesni", .cra_driver_name = "__driver-xts-camellia-aesni", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAMELLIA_BLOCK_SIZE, .cra_ctxsize = sizeof(struct camellia_xts_ctx), .cra_alignmask = 0,
Signature · 1 line
2.1.0
PATCH v2 11/20 crypto: mark CAST6 helper ciphers
In reply to Stephan MuellerFlag all CAST6 helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/cast6_avx_glue.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/crypto/cast6_avx_glue.c +10 -5
@@ -372,7 +372,8 @@ static struct crypto_alg cast6_algs[10] = { { .cra_name = "__ecb-cast6-avx", .cra_driver_name = "__driver-ecb-cast6-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAST6_BLOCK_SIZE, .cra_ctxsize = sizeof(struct cast6_ctx), .cra_alignmask = 0,
@@ -391,7 +392,8 @@ static struct crypto_alg cast6_algs[10] = { { .cra_name = "__cbc-cast6-avx", .cra_driver_name = "__driver-cbc-cast6-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAST6_BLOCK_SIZE, .cra_ctxsize = sizeof(struct cast6_ctx), .cra_alignmask = 0,
@@ -410,7 +412,8 @@ static struct crypto_alg cast6_algs[10] = { { .cra_name = "__ctr-cast6-avx", .cra_driver_name = "__driver-ctr-cast6-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct cast6_ctx), .cra_alignmask = 0,
@@ -430,7 +433,8 @@ static struct crypto_alg cast6_algs[10] = { { .cra_name = "__lrw-cast6-avx", .cra_driver_name = "__driver-lrw-cast6-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAST6_BLOCK_SIZE, .cra_ctxsize = sizeof(struct cast6_lrw_ctx), .cra_alignmask = 0,
@@ -453,7 +457,8 @@ static struct crypto_alg cast6_algs[10] = { { .cra_name = "__xts-cast6-avx", .cra_driver_name = "__driver-xts-cast6-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = CAST6_BLOCK_SIZE, .cra_ctxsize = sizeof(struct cast6_xts_ctx), .cra_alignmask = 0,
Signature · 1 line
2.1.0
PATCH v2 12/20 crypto: mark Serpent AVX2 helper ciphers
In reply to Stephan MuellerFlag all Serpent AVX2 helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/serpent_avx2_glue.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/crypto/serpent_avx2_glue.c +10 -5
@@ -309,7 +309,8 @@ static struct crypto_alg srp_algs[10] = { { .cra_name = "__ecb-serpent-avx2", .cra_driver_name = "__driver-ecb-serpent-avx2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_ctx), .cra_alignmask = 0,
@@ -329,7 +330,8 @@ static struct crypto_alg srp_algs[10] = { { .cra_name = "__cbc-serpent-avx2", .cra_driver_name = "__driver-cbc-serpent-avx2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_ctx), .cra_alignmask = 0,
@@ -349,7 +351,8 @@ static struct crypto_alg srp_algs[10] = { { .cra_name = "__ctr-serpent-avx2", .cra_driver_name = "__driver-ctr-serpent-avx2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct serpent_ctx), .cra_alignmask = 0,
@@ -370,7 +373,8 @@ static struct crypto_alg srp_algs[10] = { { .cra_name = "__lrw-serpent-avx2", .cra_driver_name = "__driver-lrw-serpent-avx2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_lrw_ctx), .cra_alignmask = 0,
@@ -394,7 +398,8 @@ static struct crypto_alg srp_algs[10] = { { .cra_name = "__xts-serpent-avx2", .cra_driver_name = "__driver-xts-serpent-avx2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_xts_ctx), .cra_alignmask = 0,
Signature · 1 line
2.1.0
PATCH v2 13/20 crypto: mark Serpent AVX helper ciphers
In reply to Stephan MuellerFlag all Serpent AVX helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/serpent_avx_glue.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/crypto/serpent_avx_glue.c +10 -5
@@ -378,7 +378,8 @@ static struct crypto_alg serpent_algs[10] = { { .cra_name = "__ecb-serpent-avx", .cra_driver_name = "__driver-ecb-serpent-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_ctx), .cra_alignmask = 0,
@@ -397,7 +398,8 @@ static struct crypto_alg serpent_algs[10] = { { .cra_name = "__cbc-serpent-avx", .cra_driver_name = "__driver-cbc-serpent-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_ctx), .cra_alignmask = 0,
@@ -416,7 +418,8 @@ static struct crypto_alg serpent_algs[10] = { { .cra_name = "__ctr-serpent-avx", .cra_driver_name = "__driver-ctr-serpent-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct serpent_ctx), .cra_alignmask = 0,
@@ -436,7 +439,8 @@ static struct crypto_alg serpent_algs[10] = { { .cra_name = "__lrw-serpent-avx", .cra_driver_name = "__driver-lrw-serpent-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_lrw_ctx), .cra_alignmask = 0,
@@ -459,7 +463,8 @@ static struct crypto_alg serpent_algs[10] = { { .cra_name = "__xts-serpent-avx", .cra_driver_name = "__driver-xts-serpent-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_xts_ctx), .cra_alignmask = 0,
Signature · 1 line
2.1.0
PATCH v2 14/20 crypto: mark Serpent SSE2 helper ciphers
In reply to Stephan MuellerFlag all Serpent SSE2 helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/serpent_sse2_glue.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/crypto/serpent_sse2_glue.c +10 -5
@@ -387,7 +387,8 @@ static struct crypto_alg serpent_algs[10] = { { .cra_name = "__ecb-serpent-sse2", .cra_driver_name = "__driver-ecb-serpent-sse2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_ctx), .cra_alignmask = 0,
@@ -406,7 +407,8 @@ static struct crypto_alg serpent_algs[10] = { { .cra_name = "__cbc-serpent-sse2", .cra_driver_name = "__driver-cbc-serpent-sse2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_ctx), .cra_alignmask = 0,
@@ -425,7 +427,8 @@ static struct crypto_alg serpent_algs[10] = { { .cra_name = "__ctr-serpent-sse2", .cra_driver_name = "__driver-ctr-serpent-sse2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct serpent_ctx), .cra_alignmask = 0,
@@ -445,7 +448,8 @@ static struct crypto_alg serpent_algs[10] = { { .cra_name = "__lrw-serpent-sse2", .cra_driver_name = "__driver-lrw-serpent-sse2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_lrw_ctx), .cra_alignmask = 0,
@@ -468,7 +472,8 @@ static struct crypto_alg serpent_algs[10] = { { .cra_name = "__xts-serpent-sse2", .cra_driver_name = "__driver-xts-serpent-sse2", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SERPENT_BLOCK_SIZE, .cra_ctxsize = sizeof(struct serpent_xts_ctx), .cra_alignmask = 0,
Signature · 1 line
2.1.0
PATCH v2 15/20 crypto: mark Twofish AVX helper ciphers
In reply to Stephan MuellerFlag all Twofish AVX helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/twofish_avx_glue.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/crypto/twofish_avx_glue.c +10 -5
@@ -340,7 +340,8 @@ static struct crypto_alg twofish_algs[10] = { { .cra_name = "__ecb-twofish-avx", .cra_driver_name = "__driver-ecb-twofish-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = TF_BLOCK_SIZE, .cra_ctxsize = sizeof(struct twofish_ctx), .cra_alignmask = 0,
@@ -359,7 +360,8 @@ static struct crypto_alg twofish_algs[10] = { { .cra_name = "__cbc-twofish-avx", .cra_driver_name = "__driver-cbc-twofish-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = TF_BLOCK_SIZE, .cra_ctxsize = sizeof(struct twofish_ctx), .cra_alignmask = 0,
@@ -378,7 +380,8 @@ static struct crypto_alg twofish_algs[10] = { { .cra_name = "__ctr-twofish-avx", .cra_driver_name = "__driver-ctr-twofish-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct twofish_ctx), .cra_alignmask = 0,
@@ -398,7 +401,8 @@ static struct crypto_alg twofish_algs[10] = { { .cra_name = "__lrw-twofish-avx", .cra_driver_name = "__driver-lrw-twofish-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = TF_BLOCK_SIZE, .cra_ctxsize = sizeof(struct twofish_lrw_ctx), .cra_alignmask = 0,
@@ -421,7 +425,8 @@ static struct crypto_alg twofish_algs[10] = { { .cra_name = "__xts-twofish-avx", .cra_driver_name = "__driver-xts-twofish-avx", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = TF_BLOCK_SIZE, .cra_ctxsize = sizeof(struct twofish_xts_ctx), .cra_alignmask = 0,
Signature · 1 line
2.1.0
PATCH v2 16/20 crypto: mark NEON bit sliced AES helper ciphers
In reply to Stephan MuellerFlag all NEON bit sliced AES helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/arm/crypto/aesbs-glue.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
arch/arm/crypto/aesbs-glue.c +6 -3
@@ -301,7 +301,8 @@ static struct crypto_alg aesbs_algs[] = { { .cra_name = "__cbc-aes-neonbs", .cra_driver_name = "__driver-cbc-aes-neonbs", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct aesbs_cbc_ctx), .cra_alignmask = 7,
@@ -319,7 +320,8 @@ static struct crypto_alg aesbs_algs[] = { { .cra_name = "__ctr-aes-neonbs", .cra_driver_name = "__driver-ctr-aes-neonbs", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct aesbs_ctr_ctx), .cra_alignmask = 7,
@@ -337,7 +339,8 @@ static struct crypto_alg aesbs_algs[] = { { .cra_name = "__xts-aes-neonbs", .cra_driver_name = "__driver-xts-aes-neonbs", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct aesbs_xts_ctx), .cra_alignmask = 7,
Signature · 1 line
2.1.0
PATCH v2 17/20 crypto: mark ARMv8 AES helper ciphers
In reply to Stephan MuellerFlag all ARMv8 AES helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/arm/crypto/aes-ce-glue.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
arch/arm/crypto/aes-ce-glue.c +8 -4
@@ -354,7 +354,8 @@ static struct crypto_alg aes_algs[] = { { .cra_name = "__ecb-aes-ce", .cra_driver_name = "__driver-ecb-aes-ce", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct crypto_aes_ctx), .cra_alignmask = 7,
@@ -372,7 +373,8 @@ static struct crypto_alg aes_algs[] = { { .cra_name = "__cbc-aes-ce", .cra_driver_name = "__driver-cbc-aes-ce", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct crypto_aes_ctx), .cra_alignmask = 7,
@@ -390,7 +392,8 @@ static struct crypto_alg aes_algs[] = { { .cra_name = "__ctr-aes-ce", .cra_driver_name = "__driver-ctr-aes-ce", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct crypto_aes_ctx), .cra_alignmask = 7,
@@ -408,7 +411,8 @@ static struct crypto_alg aes_algs[] = { { .cra_name = "__xts-aes-ce", .cra_driver_name = "__driver-xts-aes-ce", .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct crypto_aes_xts_ctx), .cra_alignmask = 7,
Signature · 1 line
2.1.0
PATCH v2 18/20 crypto: mark 64 bit ARMv8 AES helper ciphers
In reply to Stephan MuellerFlag all 64 bit ARMv8 AES helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/arm64/crypto/aes-glue.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
arch/arm64/crypto/aes-glue.c +8 -4
@@ -284,7 +284,8 @@ static struct crypto_alg aes_algs[] = { { .cra_name = "__ecb-aes-" MODE, .cra_driver_name = "__driver-ecb-aes-" MODE, .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct crypto_aes_ctx), .cra_alignmask = 7,
@@ -302,7 +303,8 @@ static struct crypto_alg aes_algs[] = { { .cra_name = "__cbc-aes-" MODE, .cra_driver_name = "__driver-cbc-aes-" MODE, .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct crypto_aes_ctx), .cra_alignmask = 7,
@@ -320,7 +322,8 @@ static struct crypto_alg aes_algs[] = { { .cra_name = "__ctr-aes-" MODE, .cra_driver_name = "__driver-ctr-aes-" MODE, .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = 1, .cra_ctxsize = sizeof(struct crypto_aes_ctx), .cra_alignmask = 7,
@@ -338,7 +341,8 @@ static struct crypto_alg aes_algs[] = { { .cra_name = "__xts-aes-" MODE, .cra_driver_name = "__driver-xts-aes-" MODE, .cra_priority = 0, - .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, + .cra_flags =CRYPTO_ALG_TYPE_BLKCIPHER | + CRYPTO_ALG_INTERNAL, .cra_blocksize = AES_BLOCK_SIZE, .cra_ctxsize = sizeof(struct crypto_aes_xts_ctx), .cra_alignmask = 7,
Signature · 1 line
2.1.0
PATCH v2 19/20 crypto: mcryptd to process CRYPTO_ALG_INTERNAL
In reply to Stephan MuellerThe mcryptd is used as a wrapper around internal ciphers. Therefore, the mcryptd must process the internal cipher by marking mcryptd as internal if the underlying cipher is an internal cipher.
Signed-off-by Stephan Mueller <[email protected]>
--- crypto/mcryptd.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-)
crypto/mcryptd.c +23 -2
@@ -258,6 +258,20 @@ out_free_inst: goto out; } +static inline void mcryptd_check_internal (struct rtattr **tb,u32 *type, +u32 *mask) +{ +struct crypto_attr_type *algt; + + algt =crypto_get_attr_type (tb); +if (IS_ERR (algt)) +return ; +if ((algt->type &CRYPTO_ALG_INTERNAL )) + *type |=CRYPTO_ALG_INTERNAL ; +if ((algt->mask &CRYPTO_ALG_INTERNAL )) + *mask |=CRYPTO_ALG_INTERNAL ; +} +static int mcryptd_hash_init_tfm (struct crypto_tfm *tfm) {struct crypto_instance *inst =crypto_tfm_alg_instance (tfm);
@@ -480,9 +494,13 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,struct ahash_instance *inst;struct shash_alg *salg;struct crypto_alg *alg; +u32 type =0 ; +u32 mask =0 ;int err; - salg =shash_attr_alg (tb[1 ],0 ,0 ); +mcryptd_check_internal (tb, &type, &mask); + + salg =shash_attr_alg (tb[1 ], type, mask);if (IS_ERR (salg))return PTR_ERR (salg);
@@ -502,7 +520,10 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,if (err) goto out_free_inst; - inst->alg.halg.base.cra_flags =CRYPTO_ALG_ASYNC ; + type =CRYPTO_ALG_ASYNC ; +if (alg->cra_flags &CRYPTO_ALG_INTERNAL ) + type |=CRYPTO_ALG_INTERNAL ; + inst->alg.halg.base.cra_flags = type; inst->alg.halg.digestsize = salg->digestsize; inst->alg.halg.base.cra_ctxsize =sizeof (struct mcryptd_hash_ctx );
Signature · 1 line
2.1.0
PATCH v2 20/20 crypto: mark Multi buffer SHA1 helper cipher
In reply to Stephan MuellerFlag all Multi buffer SHA1 helper ciphers as internal ciphers to prevent them from being called by normal users.
Signed-off-by Stephan Mueller <[email protected]>
--- arch/x86/crypto/sha-mb/sha1_mb.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/x86/crypto/sha-mb/sha1_mb.c +5 -2
@@ -694,7 +694,8 @@ static struct shash_alg sha1_mb_shash_alg = {* use ASYNC flag as some buffers in multi-buffer * algo may not have completed before hashing thread sleep */ - .cra_flags = CRYPTO_ALG_TYPE_SHASH | CRYPTO_ALG_ASYNC, + .cra_flags = CRYPTO_ALG_TYPE_SHASH | CRYPTO_ALG_ASYNC | + CRYPTO_ALG_INTERNAL, .cra_blocksize = SHA1_BLOCK_SIZE, .cra_module = THIS_MODULE, .cra_list = LIST_HEAD_INIT(sha1_mb_shash_alg.base.cra_list),
@@ -770,7 +771,9 @@ static int sha1_mb_async_init_tfm(struct crypto_tfm *tfm)struct sha1_mb_ctx *ctx =crypto_tfm_ctx (tfm);struct mcryptd_hash_ctx *mctx; - mcryptd_tfm =mcryptd_alloc_ahash ("__intel_sha1-mb" ,0 ,0 ); + mcryptd_tfm =mcryptd_alloc_ahash ("__intel_sha1-mb" , +CRYPTO_ALG_INTERNAL , +CRYPTO_ALG_INTERNAL );if (IS_ERR (mcryptd_tfm))return PTR_ERR (mcryptd_tfm); mctx =crypto_ahash_ctx (&mcryptd_tfm->base);
Signature · 1 line
2.1.0