Skip to content

Commit c80a050

Browse files
douzzerdouzzer
committed
linuxkm/lkcapi_glue.c: fix aes-cfb wrappers, and add
 WOLFSSL_DEBUG_TRACE_ERROR_CODES support for EINVAL/ENOMEM/EBADMSG; configure.ac: remove ENABLED_EXPERIMENTAL requirement for --enable-linuxkm-lkcapi-register=cfb(aes); linuxkm/module_hooks.c: omit "skipping full wolfcrypt_test" message if wc_RunAllCast_fips() was run.
1 parent 517f4bd commit c80a050

3 files changed

Lines changed: 49 additions & 30 deletions

File tree

‎configure.ac‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9063,7 +9063,6 @@ then
90639063
'cbc(aes)') test "$ENABLED_AESCBC" != "no" || AC_MSG_ERROR([linuxkm-lkcapi-register ${lkcapi_alg}: AES-CBC implementation not enabled.])
90649064
AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_AESCBC" ;;
90659065
'cfb(aes)') test "$ENABLED_AESCFB" != "no" || AC_MSG_ERROR([linuxkm-lkcapi-register ${lkcapi_alg}: AES-CFB implementation not enabled.])
9066-
test "$ENABLED_EXPERIMENTAL" = "yes" || AC_MSG_ERROR([linuxkm-lkcapi-register ${lkcapi_alg}: requires --enable-experimental.])
90679066
AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_AESCFB" ;;
90689067
'gcm(aes)') test "$ENABLED_AESGCM" != "no" || AC_MSG_ERROR([linuxkm-lkcapi-register ${lkcapi_alg}: AES-GCM implementation not enabled.])
90699068
test "$ENABLED_AESGCM_STREAM" != "no" || AC_MSG_ERROR([linuxkm-lkcapi-register ${lkcapi_alg}: --enable-aesgcm-stream is required for LKCAPI.])

‎linuxkm/lkcapi_glue.c‎

Lines changed: 45 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,22 @@ static int disable_setkey_warnings = 0;
8686
#define WOLFKM_AESGCM_DRIVER ("gcm-aes" WOLFKM_DRIVER_SUFFIX)
8787
#define WOLFKM_AESXTS_DRIVER ("xts-aes" WOLFKM_DRIVER_SUFFIX)
8888

89+
#ifdef WOLFSSL_DEBUG_TRACE_ERROR_CODES
90+
enum linux_errcodes {
91+
my_EINVAL = EINVAL,
92+
my_ENOMEM = ENOMEM,
93+
my_EBADMSG = EBADMSG
94+
};
95+
96+
#undef EINVAL
97+
#undef ENOMEM
98+
#undef EBADMSG
99+
100+
#define EINVAL WC_ERR_TRACE(my_EINVAL)
101+
#define ENOMEM WC_ERR_TRACE(my_ENOMEM)
102+
#define EBADMSG WC_ERR_TRACE(my_EBADMSG)
103+
#endif
104+
89105
#if defined(HAVE_AES_CBC) && \
90106
(defined(LINUXKM_LKCAPI_REGISTER_ALL) || \
91107
defined(LINUXKM_LKCAPI_REGISTER_AESCBC))
@@ -94,9 +110,6 @@ static int linuxkm_test_aescbc(void);
94110
#if defined(WOLFSSL_AES_CFB) && \
95111
(defined(LINUXKM_LKCAPI_REGISTER_ALL) || \
96112
defined(LINUXKM_LKCAPI_REGISTER_AESCFB))
97-
#ifndef WOLFSSL_EXPERIMENTAL_SETTINGS
98-
#error Experimental settings without WOLFSSL_EXPERIMENTAL_SETTINGS
99-
#endif
100113
static int linuxkm_test_aescfb(void);
101114
#endif
102115
#if defined(HAVE_AESGCM) && \
@@ -396,7 +409,6 @@ static int km_AesCfbEncrypt(struct skcipher_request *req)
396409
struct crypto_skcipher * tfm = NULL;
397410
struct km_AesCtx * ctx = NULL;
398411
struct skcipher_walk walk;
399-
unsigned int nbytes = 0;
400412
int err = 0;
401413

402414
tfm = crypto_skcipher_reqtfm(req);
@@ -410,26 +422,25 @@ static int km_AesCfbEncrypt(struct skcipher_request *req)
410422
return err;
411423
}
412424

413-
while ((nbytes = walk.nbytes) != 0) {
414-
err = wc_AesSetIV(ctx->aes_encrypt, walk.iv);
425+
err = wc_AesSetIV(ctx->aes_encrypt, walk.iv);
415426

416-
if (unlikely(err)) {
417-
if (! disable_setkey_warnings)
418-
pr_err("%s: wc_AesSetKey failed: %d\n",
419-
crypto_tfm_alg_driver_name(crypto_skcipher_tfm(tfm)), err);
420-
return -EINVAL;
421-
}
427+
if (unlikely(err)) {
428+
pr_err("%s: wc_AesSetIV failed: %d\n",
429+
crypto_tfm_alg_driver_name(crypto_skcipher_tfm(tfm)), err);
430+
return -EINVAL;
431+
}
422432

433+
while (walk.nbytes != 0) {
423434
err = wc_AesCfbEncrypt(ctx->aes_encrypt, walk.dst.virt.addr,
424-
walk.src.virt.addr, nbytes);
435+
walk.src.virt.addr, walk.nbytes);
425436

426437
if (unlikely(err)) {
427438
pr_err("%s: wc_AesCfbEncrypt failed %d\n",
428439
crypto_tfm_alg_driver_name(crypto_skcipher_tfm(tfm)), err);
429440
return -EINVAL;
430441
}
431442

432-
err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
443+
err = skcipher_walk_done(&walk, 0);
433444

434445
if (unlikely(err)) {
435446
pr_err("%s: skcipher_walk_done failed: %d\n",
@@ -438,6 +449,9 @@ static int km_AesCfbEncrypt(struct skcipher_request *req)
438449
}
439450
}
440451

452+
/* copy iv from wolfCrypt back to walk.iv */
453+
XMEMCPY(walk.iv, ctx->aes_encrypt->reg, WC_AES_BLOCK_SIZE);
454+
441455
return err;
442456
}
443457

@@ -446,7 +460,6 @@ static int km_AesCfbDecrypt(struct skcipher_request *req)
446460
struct crypto_skcipher * tfm = NULL;
447461
struct km_AesCtx * ctx = NULL;
448462
struct skcipher_walk walk;
449-
unsigned int nbytes = 0;
450463
int err = 0;
451464

452465
tfm = crypto_skcipher_reqtfm(req);
@@ -460,26 +473,26 @@ static int km_AesCfbDecrypt(struct skcipher_request *req)
460473
return err;
461474
}
462475

463-
while ((nbytes = walk.nbytes) != 0) {
464-
err = wc_AesSetIV(ctx->aes_encrypt, walk.iv);
476+
err = wc_AesSetIV(ctx->aes_encrypt, walk.iv);
465477

466-
if (unlikely(err)) {
467-
if (! disable_setkey_warnings)
468-
pr_err("%s: wc_AesSetKey failed: %d\n",
469-
crypto_tfm_alg_driver_name(crypto_skcipher_tfm(tfm)), err);
470-
return -EINVAL;
471-
}
478+
if (unlikely(err)) {
479+
if (! disable_setkey_warnings)
480+
pr_err("%s: wc_AesSetIV failed: %d\n",
481+
crypto_tfm_alg_driver_name(crypto_skcipher_tfm(tfm)), err);
482+
return -EINVAL;
483+
}
472484

485+
while (walk.nbytes != 0) {
473486
err = wc_AesCfbDecrypt(ctx->aes_encrypt, walk.dst.virt.addr,
474-
walk.src.virt.addr, nbytes);
487+
walk.src.virt.addr, walk.nbytes);
475488

476489
if (unlikely(err)) {
477490
pr_err("%s: wc_AesCfbDecrypt failed: %d\n",
478491
crypto_tfm_alg_driver_name(crypto_skcipher_tfm(tfm)), err);
479492
return -EINVAL;
480493
}
481494

482-
err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
495+
err = skcipher_walk_done(&walk, 0);
483496

484497
if (unlikely(err)) {
485498
pr_err("%s: skcipher_walk_done failed: %d\n",
@@ -488,14 +501,17 @@ static int km_AesCfbDecrypt(struct skcipher_request *req)
488501
}
489502
}
490503

504+
/* copy iv from wolfCrypt back to walk.iv */
505+
XMEMCPY(walk.iv, ctx->aes_encrypt->reg, WC_AES_BLOCK_SIZE);
506+
491507
return err;
492508
}
493509

494510
static struct skcipher_alg cfbAesAlg = {
495511
.base.cra_name = WOLFKM_AESCFB_NAME,
496512
.base.cra_driver_name = WOLFKM_AESCFB_DRIVER,
497513
.base.cra_priority = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
498-
.base.cra_blocksize = WC_AES_BLOCK_SIZE,
514+
.base.cra_blocksize = 1,
499515
.base.cra_ctxsize = sizeof(struct km_AesCtx),
500516
.base.cra_module = THIS_MODULE,
501517
.init = km_AesCfbInit,
@@ -597,7 +613,7 @@ static int km_AesGcmEncrypt(struct aead_request *req)
597613
if (unlikely(err)) {
598614
pr_err("%s: skcipher_walk_aead_encrypt failed: %d\n",
599615
crypto_tfm_alg_driver_name(crypto_aead_tfm(tfm)), err);
600-
return -1;
616+
return -EINVAL;
601617
}
602618

603619
err = wc_AesGcmInit(ctx->aes_encrypt, NULL /*key*/, 0 /*keylen*/, walk.iv,
@@ -831,6 +847,8 @@ static int km_AesXtsInitCommon(struct km_AesXtsCtx * ctx, const char * name)
831847

832848
if (unlikely(err)) {
833849
pr_err("%s: km_AesXtsInitCommon failed: %d\n", name, err);
850+
free(ctx->aesXts);
851+
ctx->aesXts = NULL;
834852
return -EINVAL;
835853
}
836854

‎linuxkm/module_hooks.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -270,7 +270,7 @@ static int wolfssl_init(void)
270270
}
271271
#endif
272272

273-
#ifdef HAVE_FIPS
273+
#if defined(HAVE_FIPS) && FIPS_VERSION3_GT(5,2,0)
274274
ret = wc_RunAllCast_fips();
275275
if (ret != 0) {
276276
pr_err("wc_RunAllCast_fips() failed with return value %d\n", ret);
@@ -302,7 +302,7 @@ static int wolfssl_init(void)
302302
""
303303
#endif
304304
);
305-
#endif /* HAVE_FIPS */
305+
#endif /* HAVE_FIPS && FIPS_VERSION3_GT(5,2,0) */
306306

307307
#ifndef NO_CRYPT_TEST
308308
ret = wolfcrypt_test(NULL);
@@ -314,9 +314,11 @@ static int wolfssl_init(void)
314314
}
315315
pr_info("wolfCrypt self-test passed.\n");
316316
#else
317+
#if !defined(HAVE_FIPS) || FIPS_VERSION3_LE(5,2,0)
317318
pr_info("skipping full wolfcrypt_test() "
318319
"(configure with --enable-crypttests to enable).\n");
319320
#endif
321+
#endif
320322

321323
#ifdef LINUXKM_LKCAPI_REGISTER
322324
ret = linuxkm_lkcapi_register();

0 commit comments

Comments
 (0)