crypto/drbg.c

   1 /*
   2  * DRBG: Deterministic Random Bits Generator
   3  *       Based on NIST Recommended DRBG from NIST SP800-90A with the following
   4  *       properties:
   5  *              * CTR DRBG with DF with AES-128, AES-192, AES-256 cores
   6  *              * Hash DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
   7  *              * HMAC DRBG with DF with SHA-1, SHA-256, SHA-384, SHA-512 cores
   8  *              * with and without prediction resistance
   9  *
  10  * Copyright Stephan Mueller <[email protected]>, 2014
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, and the entire permission notice in its entirety,
  17  *    including the disclaimer of warranties.
  18  * 2. Redistributions in binary form must reproduce the above copyright
  19  *    notice, this list of conditions and the following disclaimer in the
  20  *    documentation and/or other materials provided with the distribution.
  21  * 3. The name of the author may not be used to endorse or promote
  22  *    products derived from this software without specific prior
  23  *    written permission.
  24  *
  25  * ALTERNATIVELY, this product may be distributed under the terms of
  26  * the GNU General Public License, in which case the provisions of the GPL are
  27  * required INSTEAD OF the above restrictions.  (This clause is
  28  * necessary due to a potential bad interaction between the GPL and
  29  * the restrictions contained in a BSD-style copyright.)
  30  *
  31  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  32  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  33  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
  34  * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
  35  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  36  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
  37  * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  38  * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  39  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  40  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  41  * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
  42  * DAMAGE.
  43  *
  44  * DRBG Usage
  45  * ==========
  46  * The SP 800-90A DRBG allows the user to specify a personalization string
  47  * for initialization as well as an additional information string for each
  48  * random number request. The following code fragments show how a caller
  49  * uses the kernel crypto API to use the full functionality of the DRBG.
  50  *
  51  * Usage without any additional data
  52  * ---------------------------------
  53  * struct crypto_rng *drng;
  54  * int err;
  55  * char data[DATALEN];
  56  *
  57  * drng = crypto_alloc_rng(drng_name, 0, 0);
  58  * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  59  * crypto_free_rng(drng);
  60  *
  61  *
  62  * Usage with personalization string during initialization
  63  * -------------------------------------------------------
  64  * struct crypto_rng *drng;
  65  * int err;
  66  * char data[DATALEN];
  67  * struct drbg_string pers;
  68  * char personalization[11] = "some-string";
  69  *
  70  * drbg_string_fill(&pers, personalization, strlen(personalization));
  71  * drng = crypto_alloc_rng(drng_name, 0, 0);
  72  * // The reset completely re-initializes the DRBG with the provided
  73  * // personalization string
  74  * err = crypto_rng_reset(drng, &personalization, strlen(personalization));
  75  * err = crypto_rng_get_bytes(drng, &data, DATALEN);
  76  * crypto_free_rng(drng);
  77  *
  78  *
  79  * Usage with additional information string during random number request
  80  * ---------------------------------------------------------------------
  81  * struct crypto_rng *drng;
  82  * int err;
  83  * char data[DATALEN];
  84  * char addtl_string[11] = "some-string";
  85  * string drbg_string addtl;
  86  *
  87  * drbg_string_fill(&addtl, addtl_string, strlen(addtl_string));
  88  * drng = crypto_alloc_rng(drng_name, 0, 0);
  89  * // The following call is a wrapper to crypto_rng_get_bytes() and returns
  90  * // the same error codes.
  91  * err = crypto_drbg_get_bytes_addtl(drng, &data, DATALEN, &addtl);
  92  * crypto_free_rng(drng);
  93  *
  94  *
  95  * Usage with personalization and additional information strings
  96  * -------------------------------------------------------------
  97  * Just mix both scenarios above.
  98  */
  99
 100 #include <crypto/drbg.h>
 101 #include <linux/kernel.h>
 102
 103 /***************************************************************
 104  * Backend cipher definitions available to DRBG
 105  ***************************************************************/
 106
 107 /*
 108  * The order of the DRBG definitions here matter: every DRBG is registered
 109  * as stdrng. Each DRBG receives an increasing cra_priority values the later
 110  * they are defined in this array (see drbg_fill_array).
 111  *
 112  * HMAC DRBGs are favored over Hash DRBGs over CTR DRBGs, and
 113  * the SHA256 / AES 256 over other ciphers. Thus, the favored
 114  * DRBGs are the latest entries in this array.
 115  */
 116 static const struct drbg_core drbg_cores[] = {
 117 #ifdef CONFIG_CRYPTO_DRBG_CTR
 118         {
 119                 .flags = DRBG_CTR | DRBG_STRENGTH128,
 120                 .statelen = 32, /* 256 bits as defined in 10.2.1 */
 121                 .blocklen_bytes = 16,
 122                 .cra_name = "ctr_aes128",
 123                 .backend_cra_name = "aes",
 124         }, {
 125                 .flags = DRBG_CTR | DRBG_STRENGTH192,
 126                 .statelen = 40, /* 320 bits as defined in 10.2.1 */
 127                 .blocklen_bytes = 16,
 128                 .cra_name = "ctr_aes192",
 129                 .backend_cra_name = "aes",
 130         }, {
 131                 .flags = DRBG_CTR | DRBG_STRENGTH256,
 132                 .statelen = 48, /* 384 bits as defined in 10.2.1 */
 133                 .blocklen_bytes = 16,
 134                 .cra_name = "ctr_aes256",
 135                 .backend_cra_name = "aes",
 136         },
 137 #endif /* CONFIG_CRYPTO_DRBG_CTR */
 138 #ifdef CONFIG_CRYPTO_DRBG_HASH
 139         {
 140                 .flags = DRBG_HASH | DRBG_STRENGTH128,
 141                 .statelen = 55, /* 440 bits */
 142                 .blocklen_bytes = 20,
 143                 .cra_name = "sha1",
 144                 .backend_cra_name = "sha1",
 145         }, {
 146                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 147                 .statelen = 111, /* 888 bits */
 148                 .blocklen_bytes = 48,
 149                 .cra_name = "sha384",
 150                 .backend_cra_name = "sha384",
 151         }, {
 152                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 153                 .statelen = 111, /* 888 bits */
 154                 .blocklen_bytes = 64,
 155                 .cra_name = "sha512",
 156                 .backend_cra_name = "sha512",
 157         }, {
 158                 .flags = DRBG_HASH | DRBG_STRENGTH256,
 159                 .statelen = 55, /* 440 bits */
 160                 .blocklen_bytes = 32,
 161                 .cra_name = "sha256",
 162                 .backend_cra_name = "sha256",
 163         },
 164 #endif /* CONFIG_CRYPTO_DRBG_HASH */
 165 #ifdef CONFIG_CRYPTO_DRBG_HMAC
 166         {
 167                 .flags = DRBG_HMAC | DRBG_STRENGTH128,
 168                 .statelen = 20, /* block length of cipher */
 169                 .blocklen_bytes = 20,
 170                 .cra_name = "hmac_sha1",
 171                 .backend_cra_name = "hmac(sha1)",
 172         }, {
 173                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 174                 .statelen = 48, /* block length of cipher */
 175                 .blocklen_bytes = 48,
 176                 .cra_name = "hmac_sha384",
 177                 .backend_cra_name = "hmac(sha384)",
 178         }, {
 179                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 180                 .statelen = 64, /* block length of cipher */
 181                 .blocklen_bytes = 64,
 182                 .cra_name = "hmac_sha512",
 183                 .backend_cra_name = "hmac(sha512)",
 184         }, {
 185                 .flags = DRBG_HMAC | DRBG_STRENGTH256,
 186                 .statelen = 32, /* block length of cipher */
 187                 .blocklen_bytes = 32,
 188                 .cra_name = "hmac_sha256",
 189                 .backend_cra_name = "hmac(sha256)",
 190         },
 191 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
 192 };
 193
 194 static int drbg_uninstantiate(struct drbg_state *drbg);
 195
 196 /******************************************************************
 197  * Generic helper functions
 198  ******************************************************************/
 199
 200 /*
 201  * Return strength of DRBG according to SP800-90A section 8.4
 202  *
 203  * @flags DRBG flags reference
 204  *
 205  * Return: normalized strength in *bytes* value or 32 as default
 206  *         to counter programming errors
 207  */
 208 static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
 209 {
 210         switch (flags & DRBG_STRENGTH_MASK) {
 211         case DRBG_STRENGTH128:
 212                 return 16;
 213         case DRBG_STRENGTH192:
 214                 return 24;
 215         case DRBG_STRENGTH256:
 216                 return 32;
 217         default:
 218                 return 32;
 219         }
 220 }
 221
 222 /*
 223  * Convert an integer into a byte representation of this integer.
 224  * The byte representation is big-endian
 225  *
 226  * @val value to be converted
 227  * @buf buffer holding the converted integer -- caller must ensure that
 228  *      buffer size is at least 32 bit
 229  */
 230 #if (defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR))
 231 static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf)
 232 {
 233         struct s {
 234                 __be32 conv;
 235         };
 236         struct s *conversion = (struct s *) buf;
 237
 238         conversion->conv = cpu_to_be32(val);
 239 }
 240 #endif /* defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_CTR) */
 241
 242 /******************************************************************
 243  * CTR DRBG callback functions
 244  ******************************************************************/
 245
 246 #ifdef CONFIG_CRYPTO_DRBG_CTR
 247 #define CRYPTO_DRBG_CTR_STRING "CTR "
 248 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes256");
 249 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes256");
 250 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes192");
 251 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes192");
 252 MODULE_ALIAS_CRYPTO("drbg_pr_ctr_aes128");
 253 MODULE_ALIAS_CRYPTO("drbg_nopr_ctr_aes128");
 254
 255 static int drbg_kcapi_sym(struct drbg_state *drbg, const unsigned char *key,
 256                           unsigned char *outval, const struct drbg_string *in);
 257 static int drbg_init_sym_kernel(struct drbg_state *drbg);
 258 static int drbg_fini_sym_kernel(struct drbg_state *drbg);
 259
 260 /* BCC function for CTR DRBG as defined in 10.4.3 */
 261 static int drbg_ctr_bcc(struct drbg_state *drbg,
 262                         unsigned char *out, const unsigned char *key,
 263                         struct list_head *in)
 264 {
 265         int ret = 0;
 266         struct drbg_string *curr = NULL;
 267         struct drbg_string data;
 268         short cnt = 0;
 269
 270         drbg_string_fill(&data, out, drbg_blocklen(drbg));
 271
 272         /* 10.4.3 step 2 / 4 */
 273         list_for_each_entry(curr, in, list) {
 274                 const unsigned char *pos = curr->buf;
 275                 size_t len = curr->len;
 276                 /* 10.4.3 step 4.1 */
 277                 while (len) {
 278                         /* 10.4.3 step 4.2 */
 279                         if (drbg_blocklen(drbg) == cnt) {
 280                                 cnt = 0;
 281                                 ret = drbg_kcapi_sym(drbg, key, out, &data);
 282                                 if (ret)
 283                                         return ret;
 284                         }
 285                         out[cnt] ^= *pos;
 286                         pos++;
 287                         cnt++;
 288                         len--;
 289                 }
 290         }
 291         /* 10.4.3 step 4.2 for last block */
 292         if (cnt)
 293                 ret = drbg_kcapi_sym(drbg, key, out, &data);
 294
 295         return ret;
 296 }
 297
 298 /*
 299  * scratchpad usage: drbg_ctr_update is interlinked with drbg_ctr_df
 300  * (and drbg_ctr_bcc, but this function does not need any temporary buffers),
 301  * the scratchpad is used as follows:
 302  * drbg_ctr_update:
 303  *      temp
 304  *              start: drbg->scratchpad
 305  *              length: drbg_statelen(drbg) + drbg_blocklen(drbg)
 306  *                      note: the cipher writing into this variable works
 307  *                      blocklen-wise. Now, when the statelen is not a multiple
 308  *                      of blocklen, the generateion loop below "spills over"
 309  *                      by at most blocklen. Thus, we need to give sufficient
 310  *                      memory.
 311  *      df_data
 312  *              start: drbg->scratchpad +
 313  *                              drbg_statelen(drbg) + drbg_blocklen(drbg)
 314  *              length: drbg_statelen(drbg)
 315  *
 316  * drbg_ctr_df:
 317  *      pad
 318  *              start: df_data + drbg_statelen(drbg)
 319  *              length: drbg_blocklen(drbg)
 320  *      iv
 321  *              start: pad + drbg_blocklen(drbg)
 322  *              length: drbg_blocklen(drbg)
 323  *      temp
 324  *              start: iv + drbg_blocklen(drbg)
 325  *              length: drbg_satelen(drbg) + drbg_blocklen(drbg)
 326  *                      note: temp is the buffer that the BCC function operates
 327  *                      on. BCC operates blockwise. drbg_statelen(drbg)
 328  *                      is sufficient when the DRBG state length is a multiple
 329  *                      of the block size. For AES192 (and maybe other ciphers)
 330  *                      this is not correct and the length for temp is
 331  *                      insufficient (yes, that also means for such ciphers,
 332  *                      the final output of all BCC rounds are truncated).
 333  *                      Therefore, add drbg_blocklen(drbg) to cover all
 334  *                      possibilities.
 335  */
 336
 337 /* Derivation Function for CTR DRBG as defined in 10.4.2 */
 338 static int drbg_ctr_df(struct drbg_state *drbg,
 339                        unsigned char *df_data, size_t bytes_to_return,
 340                        struct list_head *seedlist)
 341 {
 342         int ret = -EFAULT;
 343         unsigned char L_N[8];
 344         /* S3 is input */
 345         struct drbg_string S1, S2, S4, cipherin;
 346         LIST_HEAD(bcc_list);
 347         unsigned char *pad = df_data + drbg_statelen(drbg);
 348         unsigned char *iv = pad + drbg_blocklen(drbg);
 349         unsigned char *temp = iv + drbg_blocklen(drbg);
 350         size_t padlen = 0;
 351         unsigned int templen = 0;
 352         /* 10.4.2 step 7 */
 353         unsigned int i = 0;
 354         /* 10.4.2 step 8 */
 355         const unsigned char *K = (unsigned char *)
 356                            "\x00\x01\x02\x03\x04\x05\x06\x07"
 357                            "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
 358                            "\x10\x11\x12\x13\x14\x15\x16\x17"
 359                            "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f";
 360         unsigned char *X;
 361         size_t generated_len = 0;
 362         size_t inputlen = 0;
 363         struct drbg_string *seed = NULL;
 364
 365         memset(pad, 0, drbg_blocklen(drbg));
 366         memset(iv, 0, drbg_blocklen(drbg));
 367
 368         /* 10.4.2 step 1 is implicit as we work byte-wise */
 369
 370         /* 10.4.2 step 2 */
 371         if ((512/8) < bytes_to_return)
 372                 return -EINVAL;
 373
 374         /* 10.4.2 step 2 -- calculate the entire length of all input data */
 375         list_for_each_entry(seed, seedlist, list)
 376                 inputlen += seed->len;
 377         drbg_cpu_to_be32(inputlen, &L_N[0]);
 378
 379         /* 10.4.2 step 3 */
 380         drbg_cpu_to_be32(bytes_to_return, &L_N[4]);
 381
 382         /* 10.4.2 step 5: length is L_N, input_string, one byte, padding */
 383         padlen = (inputlen + sizeof(L_N) + 1) % (drbg_blocklen(drbg));
 384         /* wrap the padlen appropriately */
 385         if (padlen)
 386                 padlen = drbg_blocklen(drbg) - padlen;
 387         /*
 388          * pad / padlen contains the 0x80 byte and the following zero bytes.
 389          * As the calculated padlen value only covers the number of zero
 390          * bytes, this value has to be incremented by one for the 0x80 byte.
 391          */
 392         padlen++;
 393         pad[0] = 0x80;
 394
 395         /* 10.4.2 step 4 -- first fill the linked list and then order it */
 396         drbg_string_fill(&S1, iv, drbg_blocklen(drbg));
 397         list_add_tail(&S1.list, &bcc_list);
 398         drbg_string_fill(&S2, L_N, sizeof(L_N));
 399         list_add_tail(&S2.list, &bcc_list);
 400         list_splice_tail(seedlist, &bcc_list);
 401         drbg_string_fill(&S4, pad, padlen);
 402         list_add_tail(&S4.list, &bcc_list);
 403
 404         /* 10.4.2 step 9 */
 405         while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
 406                 /*
 407                  * 10.4.2 step 9.1 - the padding is implicit as the buffer
 408                  * holds zeros after allocation -- even the increment of i
 409                  * is irrelevant as the increment remains within length of i
 410                  */
 411                 drbg_cpu_to_be32(i, iv);
 412                 /* 10.4.2 step 9.2 -- BCC and concatenation with temp */
 413                 ret = drbg_ctr_bcc(drbg, temp + templen, K, &bcc_list);
 414                 if (ret)
 415                         goto out;
 416                 /* 10.4.2 step 9.3 */
 417                 i++;
 418                 templen += drbg_blocklen(drbg);
 419         }
 420
 421         /* 10.4.2 step 11 */
 422         X = temp + (drbg_keylen(drbg));
 423         drbg_string_fill(&cipherin, X, drbg_blocklen(drbg));
 424
 425         /* 10.4.2 step 12: overwriting of outval is implemented in next step */
 426
 427         /* 10.4.2 step 13 */
 428         while (generated_len < bytes_to_return) {
 429                 short blocklen = 0;
 430                 /*
 431                  * 10.4.2 step 13.1: the truncation of the key length is
 432                  * implicit as the key is only drbg_blocklen in size based on
 433                  * the implementation of the cipher function callback
 434                  */
 435                 ret = drbg_kcapi_sym(drbg, temp, X, &cipherin);
 436                 if (ret)
 437                         goto out;
 438                 blocklen = (drbg_blocklen(drbg) <
 439                                 (bytes_to_return - generated_len)) ?
 440                             drbg_blocklen(drbg) :
 441                                 (bytes_to_return - generated_len);
 442                 /* 10.4.2 step 13.2 and 14 */
 443                 memcpy(df_data + generated_len, X, blocklen);
 444                 generated_len += blocklen;
 445         }
 446
 447         ret = 0;
 448
 449 out:
 450         memset(iv, 0, drbg_blocklen(drbg));
 451         memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
 452         memset(pad, 0, drbg_blocklen(drbg));
 453         return ret;
 454 }
 455
 456 /*
 457  * update function of CTR DRBG as defined in 10.2.1.2
 458  *
 459  * The reseed variable has an enhanced meaning compared to the update
 460  * functions of the other DRBGs as follows:
 461  * 0 => initial seed from initialization
 462  * 1 => reseed via drbg_seed
 463  * 2 => first invocation from drbg_ctr_update when addtl is present. In
 464  *      this case, the df_data scratchpad is not deleted so that it is
 465  *      available for another calls to prevent calling the DF function
 466  *      again.
 467  * 3 => second invocation from drbg_ctr_update. When the update function
 468  *      was called with addtl, the df_data memory already contains the
 469  *      DFed addtl information and we do not need to call DF again.
 470  */
 471 static int drbg_ctr_update(struct drbg_state *drbg, struct list_head *seed,
 472                            int reseed)
 473 {
 474         int ret = -EFAULT;
 475         /* 10.2.1.2 step 1 */
 476         unsigned char *temp = drbg->scratchpad;
 477         unsigned char *df_data = drbg->scratchpad + drbg_statelen(drbg) +
 478                                  drbg_blocklen(drbg);
 479         unsigned char *temp_p, *df_data_p; /* pointer to iterate over buffers */
 480         unsigned int len = 0;
 481         struct drbg_string cipherin;
 482
 483         if (3 > reseed)
 484                 memset(df_data, 0, drbg_statelen(drbg));
 485
 486         /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
 487         if (seed) {
 488                 ret = drbg_ctr_df(drbg, df_data, drbg_statelen(drbg), seed);
 489                 if (ret)
 490                         goto out;
 491         }
 492
 493         drbg_string_fill(&cipherin, drbg->V, drbg_blocklen(drbg));
 494         /*
 495          * 10.2.1.3.2 steps 2 and 3 are already covered as the allocation
 496          * zeroizes all memory during initialization
 497          */
 498         while (len < (drbg_statelen(drbg))) {
 499                 /* 10.2.1.2 step 2.1 */
 500                 crypto_inc(drbg->V, drbg_blocklen(drbg));
 501                 /*
 502                  * 10.2.1.2 step 2.2 */
 503                 ret = drbg_kcapi_sym(drbg, drbg->C, temp + len, &cipherin);
 504                 if (ret)
 505                         goto out;
 506                 /* 10.2.1.2 step 2.3 and 3 */
 507                 len += drbg_blocklen(drbg);
 508         }
 509
 510         /* 10.2.1.2 step 4 */
 511         temp_p = temp;
 512         df_data_p = df_data;
 513         for (len = 0; len < drbg_statelen(drbg); len++) {
 514                 *temp_p ^= *df_data_p;
 515                 df_data_p++; temp_p++;
 516         }
 517
 518         /* 10.2.1.2 step 5 */
 519         memcpy(drbg->C, temp, drbg_keylen(drbg));
 520         /* 10.2.1.2 step 6 */
 521         memcpy(drbg->V, temp + drbg_keylen(drbg), drbg_blocklen(drbg));
 522         ret = 0;
 523
 524 out:
 525         memset(temp, 0, drbg_statelen(drbg) + drbg_blocklen(drbg));
 526         if (2 != reseed)
 527                 memset(df_data, 0, drbg_statelen(drbg));
 528         return ret;
 529 }
 530
 531 /*
 532  * scratchpad use: drbg_ctr_update is called independently from
 533  * drbg_ctr_extract_bytes. Therefore, the scratchpad is reused
 534  */
 535 /* Generate function of CTR DRBG as defined in 10.2.1.5.2 */
 536 static int drbg_ctr_generate(struct drbg_state *drbg,
 537                              unsigned char *buf, unsigned int buflen,
 538                              struct list_head *addtl)
 539 {
 540         int len = 0;
 541         int ret = 0;
 542         struct drbg_string data;
 543
 544         /* 10.2.1.5.2 step 2 */
 545         if (addtl && !list_empty(addtl)) {
 546                 ret = drbg_ctr_update(drbg, addtl, 2);
 547                 if (ret)
 548                         return 0;
 549         }
 550
 551         /* 10.2.1.5.2 step 4.1 */
 552         crypto_inc(drbg->V, drbg_blocklen(drbg));
 553         drbg_string_fill(&data, drbg->V, drbg_blocklen(drbg));
 554         while (len < buflen) {
 555                 int outlen = 0;
 556                 /* 10.2.1.5.2 step 4.2 */
 557                 ret = drbg_kcapi_sym(drbg, drbg->C, drbg->scratchpad, &data);
 558                 if (ret) {
 559                         len = ret;
 560                         goto out;
 561                 }
 562                 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 563                           drbg_blocklen(drbg) : (buflen - len);
 564                 /* 10.2.1.5.2 step 4.3 */
 565                 memcpy(buf + len, drbg->scratchpad, outlen);
 566                 len += outlen;
 567                 /* 10.2.1.5.2 step 6 */
 568                 if (len < buflen)
 569                         crypto_inc(drbg->V, drbg_blocklen(drbg));
 570         }
 571
 572         /* 10.2.1.5.2 step 6 */
 573         ret = drbg_ctr_update(drbg, NULL, 3);
 574         if (ret)
 575                 len = ret;
 576
 577 out:
 578         memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
 579         return len;
 580 }
 581
 582 static const struct drbg_state_ops drbg_ctr_ops = {
 583         .update         = drbg_ctr_update,
 584         .generate       = drbg_ctr_generate,
 585         .crypto_init    = drbg_init_sym_kernel,
 586         .crypto_fini    = drbg_fini_sym_kernel,
 587 };
 588 #endif /* CONFIG_CRYPTO_DRBG_CTR */
 589
 590 /******************************************************************
 591  * HMAC DRBG callback functions
 592  ******************************************************************/
 593
 594 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
 595 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
 596                            const struct list_head *in);
 597 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
 598                                   const unsigned char *key);
 599 static int drbg_init_hash_kernel(struct drbg_state *drbg);
 600 static int drbg_fini_hash_kernel(struct drbg_state *drbg);
 601 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
 602
 603 #ifdef CONFIG_CRYPTO_DRBG_HMAC
 604 #define CRYPTO_DRBG_HMAC_STRING "HMAC "
 605 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha512");
 606 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha512");
 607 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha384");
 608 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha384");
 609 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha256");
 610 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha256");
 611 MODULE_ALIAS_CRYPTO("drbg_pr_hmac_sha1");
 612 MODULE_ALIAS_CRYPTO("drbg_nopr_hmac_sha1");
 613
 614 /* update function of HMAC DRBG as defined in 10.1.2.2 */
 615 static int drbg_hmac_update(struct drbg_state *drbg, struct list_head *seed,
 616                             int reseed)
 617 {
 618         int ret = -EFAULT;
 619         int i = 0;
 620         struct drbg_string seed1, seed2, vdata;
 621         LIST_HEAD(seedlist);
 622         LIST_HEAD(vdatalist);
 623
 624         if (!reseed) {
 625                 /* 10.1.2.3 step 2 -- memset(0) of C is implicit with kzalloc */
 626                 memset(drbg->V, 1, drbg_statelen(drbg));
 627                 drbg_kcapi_hmacsetkey(drbg, drbg->C);
 628         }
 629
 630         drbg_string_fill(&seed1, drbg->V, drbg_statelen(drbg));
 631         list_add_tail(&seed1.list, &seedlist);
 632         /* buffer of seed2 will be filled in for loop below with one byte */
 633         drbg_string_fill(&seed2, NULL, 1);
 634         list_add_tail(&seed2.list, &seedlist);
 635         /* input data of seed is allowed to be NULL at this point */
 636         if (seed)
 637                 list_splice_tail(seed, &seedlist);
 638
 639         drbg_string_fill(&vdata, drbg->V, drbg_statelen(drbg));
 640         list_add_tail(&vdata.list, &vdatalist);
 641         for (i = 2; 0 < i; i--) {
 642                 /* first round uses 0x0, second 0x1 */
 643                 unsigned char prefix = DRBG_PREFIX0;
 644                 if (1 == i)
 645                         prefix = DRBG_PREFIX1;
 646                 /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
 647                 seed2.buf = &prefix;
 648                 ret = drbg_kcapi_hash(drbg, drbg->C, &seedlist);
 649                 if (ret)
 650                         return ret;
 651                 drbg_kcapi_hmacsetkey(drbg, drbg->C);
 652
 653                 /* 10.1.2.2 step 2 and 5 -- HMAC for V */
 654                 ret = drbg_kcapi_hash(drbg, drbg->V, &vdatalist);
 655                 if (ret)
 656                         return ret;
 657
 658                 /* 10.1.2.2 step 3 */
 659                 if (!seed)
 660                         return ret;
 661         }
 662
 663         return 0;
 664 }
 665
 666 /* generate function of HMAC DRBG as defined in 10.1.2.5 */
 667 static int drbg_hmac_generate(struct drbg_state *drbg,
 668                               unsigned char *buf,
 669                               unsigned int buflen,
 670                               struct list_head *addtl)
 671 {
 672         int len = 0;
 673         int ret = 0;
 674         struct drbg_string data;
 675         LIST_HEAD(datalist);
 676
 677         /* 10.1.2.5 step 2 */
 678         if (addtl && !list_empty(addtl)) {
 679                 ret = drbg_hmac_update(drbg, addtl, 1);
 680                 if (ret)
 681                         return ret;
 682         }
 683
 684         drbg_string_fill(&data, drbg->V, drbg_statelen(drbg));
 685         list_add_tail(&data.list, &datalist);
 686         while (len < buflen) {
 687                 unsigned int outlen = 0;
 688                 /* 10.1.2.5 step 4.1 */
 689                 ret = drbg_kcapi_hash(drbg, drbg->V, &datalist);
 690                 if (ret)
 691                         return ret;
 692                 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 693                           drbg_blocklen(drbg) : (buflen - len);
 694
 695                 /* 10.1.2.5 step 4.2 */
 696                 memcpy(buf + len, drbg->V, outlen);
 697                 len += outlen;
 698         }
 699
 700         /* 10.1.2.5 step 6 */
 701         if (addtl && !list_empty(addtl))
 702                 ret = drbg_hmac_update(drbg, addtl, 1);
 703         else
 704                 ret = drbg_hmac_update(drbg, NULL, 1);
 705         if (ret)
 706                 return ret;
 707
 708         return len;
 709 }
 710
 711 static const struct drbg_state_ops drbg_hmac_ops = {
 712         .update         = drbg_hmac_update,
 713         .generate       = drbg_hmac_generate,
 714         .crypto_init    = drbg_init_hash_kernel,
 715         .crypto_fini    = drbg_fini_hash_kernel,
 716 };
 717 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
 718
 719 /******************************************************************
 720  * Hash DRBG callback functions
 721  ******************************************************************/
 722
 723 #ifdef CONFIG_CRYPTO_DRBG_HASH
 724 #define CRYPTO_DRBG_HASH_STRING "HASH "
 725 MODULE_ALIAS_CRYPTO("drbg_pr_sha512");
 726 MODULE_ALIAS_CRYPTO("drbg_nopr_sha512");
 727 MODULE_ALIAS_CRYPTO("drbg_pr_sha384");
 728 MODULE_ALIAS_CRYPTO("drbg_nopr_sha384");
 729 MODULE_ALIAS_CRYPTO("drbg_pr_sha256");
 730 MODULE_ALIAS_CRYPTO("drbg_nopr_sha256");
 731 MODULE_ALIAS_CRYPTO("drbg_pr_sha1");
 732 MODULE_ALIAS_CRYPTO("drbg_nopr_sha1");
 733
 734 /*
 735  * Increment buffer
 736  *
 737  * @dst buffer to increment
 738  * @add value to add
 739  */
 740 static inline void drbg_add_buf(unsigned char *dst, size_t dstlen,
 741                                 const unsigned char *add, size_t addlen)
 742 {
 743         /* implied: dstlen > addlen */
 744         unsigned char *dstptr;
 745         const unsigned char *addptr;
 746         unsigned int remainder = 0;
 747         size_t len = addlen;
 748
 749         dstptr = dst + (dstlen-1);
 750         addptr = add + (addlen-1);
 751         while (len) {
 752                 remainder += *dstptr + *addptr;
 753                 *dstptr = remainder & 0xff;
 754                 remainder >>= 8;
 755                 len--; dstptr--; addptr--;
 756         }
 757         len = dstlen - addlen;
 758         while (len && remainder > 0) {
 759                 remainder = *dstptr + 1;
 760                 *dstptr = remainder & 0xff;
 761                 remainder >>= 8;
 762                 len--; dstptr--;
 763         }
 764 }
 765
 766 /*
 767  * scratchpad usage: as drbg_hash_update and drbg_hash_df are used
 768  * interlinked, the scratchpad is used as follows:
 769  * drbg_hash_update
 770  *      start: drbg->scratchpad
 771  *      length: drbg_statelen(drbg)
 772  * drbg_hash_df:
 773  *      start: drbg->scratchpad + drbg_statelen(drbg)
 774  *      length: drbg_blocklen(drbg)
 775  *
 776  * drbg_hash_process_addtl uses the scratchpad, but fully completes
 777  * before either of the functions mentioned before are invoked. Therefore,
 778  * drbg_hash_process_addtl does not need to be specifically considered.
 779  */
 780
 781 /* Derivation Function for Hash DRBG as defined in 10.4.1 */
 782 static int drbg_hash_df(struct drbg_state *drbg,
 783                         unsigned char *outval, size_t outlen,
 784                         struct list_head *entropylist)
 785 {
 786         int ret = 0;
 787         size_t len = 0;
 788         unsigned char input[5];
 789         unsigned char *tmp = drbg->scratchpad + drbg_statelen(drbg);
 790         struct drbg_string data;
 791
 792         /* 10.4.1 step 3 */
 793         input[0] = 1;
 794         drbg_cpu_to_be32((outlen * 8), &input[1]);
 795
 796         /* 10.4.1 step 4.1 -- concatenation of data for input into hash */
 797         drbg_string_fill(&data, input, 5);
 798         list_add(&data.list, entropylist);
 799
 800         /* 10.4.1 step 4 */
 801         while (len < outlen) {
 802                 short blocklen = 0;
 803                 /* 10.4.1 step 4.1 */
 804                 ret = drbg_kcapi_hash(drbg, tmp, entropylist);
 805                 if (ret)
 806                         goto out;
 807                 /* 10.4.1 step 4.2 */
 808                 input[0]++;
 809                 blocklen = (drbg_blocklen(drbg) < (outlen - len)) ?
 810                             drbg_blocklen(drbg) : (outlen - len);
 811                 memcpy(outval + len, tmp, blocklen);
 812                 len += blocklen;
 813         }
 814
 815 out:
 816         memset(tmp, 0, drbg_blocklen(drbg));
 817         return ret;
 818 }
 819
 820 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
 821 static int drbg_hash_update(struct drbg_state *drbg, struct list_head *seed,
 822                             int reseed)
 823 {
 824         int ret = 0;
 825         struct drbg_string data1, data2;
 826         LIST_HEAD(datalist);
 827         LIST_HEAD(datalist2);
 828         unsigned char *V = drbg->scratchpad;
 829         unsigned char prefix = DRBG_PREFIX1;
 830
 831         if (!seed)
 832                 return -EINVAL;
 833
 834         if (reseed) {
 835                 /* 10.1.1.3 step 1 */
 836                 memcpy(V, drbg->V, drbg_statelen(drbg));
 837                 drbg_string_fill(&data1, &prefix, 1);
 838                 list_add_tail(&data1.list, &datalist);
 839                 drbg_string_fill(&data2, V, drbg_statelen(drbg));
 840                 list_add_tail(&data2.list, &datalist);
 841         }
 842         list_splice_tail(seed, &datalist);
 843
 844         /* 10.1.1.2 / 10.1.1.3 step 2 and 3 */
 845         ret = drbg_hash_df(drbg, drbg->V, drbg_statelen(drbg), &datalist);
 846         if (ret)
 847                 goto out;
 848
 849         /* 10.1.1.2 / 10.1.1.3 step 4  */
 850         prefix = DRBG_PREFIX0;
 851         drbg_string_fill(&data1, &prefix, 1);
 852         list_add_tail(&data1.list, &datalist2);
 853         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 854         list_add_tail(&data2.list, &datalist2);
 855         /* 10.1.1.2 / 10.1.1.3 step 4 */
 856         ret = drbg_hash_df(drbg, drbg->C, drbg_statelen(drbg), &datalist2);
 857
 858 out:
 859         memset(drbg->scratchpad, 0, drbg_statelen(drbg));
 860         return ret;
 861 }
 862
 863 /* processing of additional information string for Hash DRBG */
 864 static int drbg_hash_process_addtl(struct drbg_state *drbg,
 865                                    struct list_head *addtl)
 866 {
 867         int ret = 0;
 868         struct drbg_string data1, data2;
 869         LIST_HEAD(datalist);
 870         unsigned char prefix = DRBG_PREFIX2;
 871
 872         /* 10.1.1.4 step 2 */
 873         if (!addtl || list_empty(addtl))
 874                 return 0;
 875
 876         /* 10.1.1.4 step 2a */
 877         drbg_string_fill(&data1, &prefix, 1);
 878         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 879         list_add_tail(&data1.list, &datalist);
 880         list_add_tail(&data2.list, &datalist);
 881         list_splice_tail(addtl, &datalist);
 882         ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
 883         if (ret)
 884                 goto out;
 885
 886         /* 10.1.1.4 step 2b */
 887         drbg_add_buf(drbg->V, drbg_statelen(drbg),
 888                      drbg->scratchpad, drbg_blocklen(drbg));
 889
 890 out:
 891         memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
 892         return ret;
 893 }
 894
 895 /* Hashgen defined in 10.1.1.4 */
 896 static int drbg_hash_hashgen(struct drbg_state *drbg,
 897                              unsigned char *buf,
 898                              unsigned int buflen)
 899 {
 900         int len = 0;
 901         int ret = 0;
 902         unsigned char *src = drbg->scratchpad;
 903         unsigned char *dst = drbg->scratchpad + drbg_statelen(drbg);
 904         struct drbg_string data;
 905         LIST_HEAD(datalist);
 906
 907         /* 10.1.1.4 step hashgen 2 */
 908         memcpy(src, drbg->V, drbg_statelen(drbg));
 909
 910         drbg_string_fill(&data, src, drbg_statelen(drbg));
 911         list_add_tail(&data.list, &datalist);
 912         while (len < buflen) {
 913                 unsigned int outlen = 0;
 914                 /* 10.1.1.4 step hashgen 4.1 */
 915                 ret = drbg_kcapi_hash(drbg, dst, &datalist);
 916                 if (ret) {
 917                         len = ret;
 918                         goto out;
 919                 }
 920                 outlen = (drbg_blocklen(drbg) < (buflen - len)) ?
 921                           drbg_blocklen(drbg) : (buflen - len);
 922                 /* 10.1.1.4 step hashgen 4.2 */
 923                 memcpy(buf + len, dst, outlen);
 924                 len += outlen;
 925                 /* 10.1.1.4 hashgen step 4.3 */
 926                 if (len < buflen)
 927                         crypto_inc(src, drbg_statelen(drbg));
 928         }
 929
 930 out:
 931         memset(drbg->scratchpad, 0,
 932                (drbg_statelen(drbg) + drbg_blocklen(drbg)));
 933         return len;
 934 }
 935
 936 /* generate function for Hash DRBG as defined in  10.1.1.4 */
 937 static int drbg_hash_generate(struct drbg_state *drbg,
 938                               unsigned char *buf, unsigned int buflen,
 939                               struct list_head *addtl)
 940 {
 941         int len = 0;
 942         int ret = 0;
 943         union {
 944                 unsigned char req[8];
 945                 __be64 req_int;
 946         } u;
 947         unsigned char prefix = DRBG_PREFIX3;
 948         struct drbg_string data1, data2;
 949         LIST_HEAD(datalist);
 950
 951         /* 10.1.1.4 step 2 */
 952         ret = drbg_hash_process_addtl(drbg, addtl);
 953         if (ret)
 954                 return ret;
 955         /* 10.1.1.4 step 3 */
 956         len = drbg_hash_hashgen(drbg, buf, buflen);
 957
 958         /* this is the value H as documented in 10.1.1.4 */
 959         /* 10.1.1.4 step 4 */
 960         drbg_string_fill(&data1, &prefix, 1);
 961         list_add_tail(&data1.list, &datalist);
 962         drbg_string_fill(&data2, drbg->V, drbg_statelen(drbg));
 963         list_add_tail(&data2.list, &datalist);
 964         ret = drbg_kcapi_hash(drbg, drbg->scratchpad, &datalist);
 965         if (ret) {
 966                 len = ret;
 967                 goto out;
 968         }
 969
 970         /* 10.1.1.4 step 5 */
 971         drbg_add_buf(drbg->V, drbg_statelen(drbg),
 972                      drbg->scratchpad, drbg_blocklen(drbg));
 973         drbg_add_buf(drbg->V, drbg_statelen(drbg),
 974                      drbg->C, drbg_statelen(drbg));
 975         u.req_int = cpu_to_be64(drbg->reseed_ctr);
 976         drbg_add_buf(drbg->V, drbg_statelen(drbg), u.req, 8);
 977
 978 out:
 979         memset(drbg->scratchpad, 0, drbg_blocklen(drbg));
 980         return len;
 981 }
 982
 983 /*
 984  * scratchpad usage: as update and generate are used isolated, both
 985  * can use the scratchpad
 986  */
 987 static const struct drbg_state_ops drbg_hash_ops = {
 988         .update         = drbg_hash_update,
 989         .generate       = drbg_hash_generate,
 990         .crypto_init    = drbg_init_hash_kernel,
 991         .crypto_fini    = drbg_fini_hash_kernel,
 992 };
 993 #endif /* CONFIG_CRYPTO_DRBG_HASH */
 994
 995 /******************************************************************
 996  * Functions common for DRBG implementations
 997  ******************************************************************/
 998
 999 static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
1000                               int reseed)
1001 {
1002         int ret = drbg->d_ops->update(drbg, seed, reseed);
1003
1004         if (ret)
1005                 return ret;
1006
1007         drbg->seeded = true;
1008         /* 10.1.1.2 / 10.1.1.3 step 5 */
1009         drbg->reseed_ctr = 1;
1010
1011         return ret;
1012 }
1013
1014 static void drbg_async_seed(struct work_struct *work)
1015 {
1016         struct drbg_string data;
1017         LIST_HEAD(seedlist);
1018         struct drbg_state *drbg = container_of(work, struct drbg_state,
1019                                                seed_work);
1020         unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1021         unsigned char entropy[32];
1022
1023         BUG_ON(!entropylen);
1024         BUG_ON(entropylen > sizeof(entropy));
1025         get_random_bytes(entropy, entropylen);
1026
1027         drbg_string_fill(&data, entropy, entropylen);
1028         list_add_tail(&data.list, &seedlist);
1029
1030         mutex_lock(&drbg->drbg_mutex);
1031
1032         /* If nonblocking pool is initialized, deactivate Jitter RNG */
1033         crypto_free_rng(drbg->jent);
1034         drbg->jent = NULL;
1035
1036         /* Set seeded to false so that if __drbg_seed fails the
1037          * next generate call will trigger a reseed.
1038          */
1039         drbg->seeded = false;
1040
1041         __drbg_seed(drbg, &seedlist, true);
1042
1043         if (drbg->seeded)
1044                 drbg->reseed_threshold = drbg_max_requests(drbg);
1045
1046         mutex_unlock(&drbg->drbg_mutex);
1047
1048         memzero_explicit(entropy, entropylen);
1049 }
1050
1051 /*
1052  * Seeding or reseeding of the DRBG
1053  *
1054  * @drbg: DRBG state struct
1055  * @pers: personalization / additional information buffer
1056  * @reseed: 0 for initial seed process, 1 for reseeding
1057  *
1058  * return:
1059  *      0 on success
1060  *      error value otherwise
1061  */
1062 static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
1063                      bool reseed)
1064 {
1065         int ret;
1066         unsigned char entropy[((32 + 16) * 2)];
1067         unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
1068         struct drbg_string data1;
1069         LIST_HEAD(seedlist);
1070
1071         /* 9.1 / 9.2 / 9.3.1 step 3 */
1072         if (pers && pers->len > (drbg_max_addtl(drbg))) {
1073                 pr_devel("DRBG: personalization string too long %zu\n",
1074                          pers->len);
1075                 return -EINVAL;
1076         }
1077
1078         if (list_empty(&drbg->test_data.list)) {
1079                 drbg_string_fill(&data1, drbg->test_data.buf,
1080                                  drbg->test_data.len);
1081                 pr_devel("DRBG: using test entropy\n");
1082         } else {
1083                 /*
1084                  * Gather entropy equal to the security strength of the DRBG.
1085                  * With a derivation function, a nonce is required in addition
1086                  * to the entropy. A nonce must be at least 1/2 of the security
1087                  * strength of the DRBG in size. Thus, entropy + nonce is 3/2
1088                  * of the strength. The consideration of a nonce is only
1089                  * applicable during initial seeding.
1090                  */
1091                 BUG_ON(!entropylen);
1092                 if (!reseed)
1093                         entropylen = ((entropylen + 1) / 2) * 3;
1094                 BUG_ON((entropylen * 2) > sizeof(entropy));
1095
1096                 /* Get seed from in-kernel /dev/urandom */
1097                 get_random_bytes(entropy, entropylen);
1098
1099                 if (!drbg->jent) {
1100                         drbg_string_fill(&data1, entropy, entropylen);
1101                         pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1102                                  entropylen);
1103                 } else {
1104                         /* Get seed from Jitter RNG */
1105                         ret = crypto_rng_get_bytes(drbg->jent,
1106                                                    entropy + entropylen,
1107                                                    entropylen);
1108                         if (ret) {
1109                                 pr_devel("DRBG: jent failed with %d\n", ret);
1110                                 return ret;
1111                         }
1112
1113                         drbg_string_fill(&data1, entropy, entropylen * 2);
1114                         pr_devel("DRBG: (re)seeding with %u bytes of entropy\n",
1115                                  entropylen * 2);
1116                 }
1117         }
1118         list_add_tail(&data1.list, &seedlist);
1119
1120         /*
1121          * concatenation of entropy with personalization str / addtl input)
1122          * the variable pers is directly handed in by the caller, so check its
1123          * contents whether it is appropriate
1124          */
1125         if (pers && pers->buf && 0 < pers->len) {
1126                 list_add_tail(&pers->list, &seedlist);
1127                 pr_devel("DRBG: using personalization string\n");
1128         }
1129
1130         if (!reseed) {
1131                 memset(drbg->V, 0, drbg_statelen(drbg));
1132                 memset(drbg->C, 0, drbg_statelen(drbg));
1133         }
1134
1135         ret = __drbg_seed(drbg, &seedlist, reseed);
1136
1137         memzero_explicit(entropy, entropylen * 2);
1138
1139         return ret;
1140 }
1141
1142 /* Free all substructures in a DRBG state without the DRBG state structure */
1143 static inline void drbg_dealloc_state(struct drbg_state *drbg)
1144 {
1145         if (!drbg)
1146                 return;
1147         kzfree(drbg->V);
1148         drbg->V = NULL;
1149         kzfree(drbg->C);
1150         drbg->C = NULL;
1151         kzfree(drbg->scratchpad);
1152         drbg->scratchpad = NULL;
1153         drbg->reseed_ctr = 0;
1154         drbg->d_ops = NULL;
1155         drbg->core = NULL;
1156 }
1157
1158 /*
1159  * Allocate all sub-structures for a DRBG state.
1160  * The DRBG state structure must already be allocated.
1161  */
1162 static inline int drbg_alloc_state(struct drbg_state *drbg)
1163 {
1164         int ret = -ENOMEM;
1165         unsigned int sb_size = 0;
1166
1167         switch (drbg->core->flags & DRBG_TYPE_MASK) {
1168 #ifdef CONFIG_CRYPTO_DRBG_HMAC
1169         case DRBG_HMAC:
1170                 drbg->d_ops = &drbg_hmac_ops;
1171                 break;
1172 #endif /* CONFIG_CRYPTO_DRBG_HMAC */
1173 #ifdef CONFIG_CRYPTO_DRBG_HASH
1174         case DRBG_HASH:
1175                 drbg->d_ops = &drbg_hash_ops;
1176                 break;
1177 #endif /* CONFIG_CRYPTO_DRBG_HASH */
1178 #ifdef CONFIG_CRYPTO_DRBG_CTR
1179         case DRBG_CTR:
1180                 drbg->d_ops = &drbg_ctr_ops;
1181                 break;
1182 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1183         default:
1184                 ret = -EOPNOTSUPP;
1185                 goto err;
1186         }
1187
1188         drbg->V = kmalloc(drbg_statelen(drbg), GFP_KERNEL);
1189         if (!drbg->V)
1190                 goto err;
1191         drbg->C = kmalloc(drbg_statelen(drbg), GFP_KERNEL);
1192         if (!drbg->C)
1193                 goto err;
1194         /* scratchpad is only generated for CTR and Hash */
1195         if (drbg->core->flags & DRBG_HMAC)
1196                 sb_size = 0;
1197         else if (drbg->core->flags & DRBG_CTR)
1198                 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg) + /* temp */
1199                           drbg_statelen(drbg) + /* df_data */
1200                           drbg_blocklen(drbg) + /* pad */
1201                           drbg_blocklen(drbg) + /* iv */
1202                           drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */
1203         else
1204                 sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg);
1205
1206         if (0 < sb_size) {
1207                 drbg->scratchpad = kzalloc(sb_size, GFP_KERNEL);
1208                 if (!drbg->scratchpad)
1209                         goto err;
1210         }
1211
1212         return 0;
1213
1214 err:
1215         drbg_dealloc_state(drbg);
1216         return ret;
1217 }
1218
1219 /*************************************************************************
1220  * DRBG interface functions
1221  *************************************************************************/
1222
1223 /*
1224  * DRBG generate function as required by SP800-90A - this function
1225  * generates random numbers
1226  *
1227  * @drbg DRBG state handle
1228  * @buf Buffer where to store the random numbers -- the buffer must already
1229  *      be pre-allocated by caller
1230  * @buflen Length of output buffer - this value defines the number of random
1231  *         bytes pulled from DRBG
1232  * @addtl Additional input that is mixed into state, may be NULL -- note
1233  *        the entropy is pulled by the DRBG internally unconditionally
1234  *        as defined in SP800-90A. The additional input is mixed into
1235  *        the state in addition to the pulled entropy.
1236  *
1237  * return: 0 when all bytes are generated; < 0 in case of an error
1238  */
1239 static int drbg_generate(struct drbg_state *drbg,
1240                          unsigned char *buf, unsigned int buflen,
1241                          struct drbg_string *addtl)
1242 {
1243         int len = 0;
1244         LIST_HEAD(addtllist);
1245
1246         if (!drbg->core) {
1247                 pr_devel("DRBG: not yet seeded\n");
1248                 return -EINVAL;
1249         }
1250         if (0 == buflen || !buf) {
1251                 pr_devel("DRBG: no output buffer provided\n");
1252                 return -EINVAL;
1253         }
1254         if (addtl && NULL == addtl->buf && 0 < addtl->len) {
1255                 pr_devel("DRBG: wrong format of additional information\n");
1256                 return -EINVAL;
1257         }
1258
1259         /* 9.3.1 step 2 */
1260         len = -EINVAL;
1261         if (buflen > (drbg_max_request_bytes(drbg))) {
1262                 pr_devel("DRBG: requested random numbers too large %u\n",
1263                          buflen);
1264                 goto err;
1265         }
1266
1267         /* 9.3.1 step 3 is implicit with the chosen DRBG */
1268
1269         /* 9.3.1 step 4 */
1270         if (addtl && addtl->len > (drbg_max_addtl(drbg))) {
1271                 pr_devel("DRBG: additional information string too long %zu\n",
1272                          addtl->len);
1273                 goto err;
1274         }
1275         /* 9.3.1 step 5 is implicit with the chosen DRBG */
1276
1277         /*
1278          * 9.3.1 step 6 and 9 supplemented by 9.3.2 step c is implemented
1279          * here. The spec is a bit convoluted here, we make it simpler.
1280          */
1281         if (drbg->reseed_threshold < drbg->reseed_ctr)
1282                 drbg->seeded = false;
1283
1284         if (drbg->pr || !drbg->seeded) {
1285                 pr_devel("DRBG: reseeding before generation (prediction "
1286                          "resistance: %s, state %s)\n",
1287                          drbg->pr ? "true" : "false",
1288                          drbg->seeded ? "seeded" : "unseeded");
1289                 /* 9.3.1 steps 7.1 through 7.3 */
1290                 len = drbg_seed(drbg, addtl, true);
1291                 if (len)
1292                         goto err;
1293                 /* 9.3.1 step 7.4 */
1294                 addtl = NULL;
1295         }
1296
1297         if (addtl && 0 < addtl->len)
1298                 list_add_tail(&addtl->list, &addtllist);
1299         /* 9.3.1 step 8 and 10 */
1300         len = drbg->d_ops->generate(drbg, buf, buflen, &addtllist);
1301
1302         /* 10.1.1.4 step 6, 10.1.2.5 step 7, 10.2.1.5.2 step 7 */
1303         drbg->reseed_ctr++;
1304         if (0 >= len)
1305                 goto err;
1306
1307         /*
1308          * Section 11.3.3 requires to re-perform self tests after some
1309          * generated random numbers. The chosen value after which self
1310          * test is performed is arbitrary, but it should be reasonable.
1311          * However, we do not perform the self tests because of the following
1312          * reasons: it is mathematically impossible that the initial self tests
1313          * were successfully and the following are not. If the initial would
1314          * pass and the following would not, the kernel integrity is violated.
1315          * In this case, the entire kernel operation is questionable and it
1316          * is unlikely that the integrity violation only affects the
1317          * correct operation of the DRBG.
1318          *
1319          * Albeit the following code is commented out, it is provided in
1320          * case somebody has a need to implement the test of 11.3.3.
1321          */
1322 #if 0
1323         if (drbg->reseed_ctr && !(drbg->reseed_ctr % 4096)) {
1324                 int err = 0;
1325                 pr_devel("DRBG: start to perform self test\n");
1326                 if (drbg->core->flags & DRBG_HMAC)
1327                         err = alg_test("drbg_pr_hmac_sha256",
1328                                        "drbg_pr_hmac_sha256", 0, 0);
1329                 else if (drbg->core->flags & DRBG_CTR)
1330                         err = alg_test("drbg_pr_ctr_aes128",
1331                                        "drbg_pr_ctr_aes128", 0, 0);
1332                 else
1333                         err = alg_test("drbg_pr_sha256",
1334                                        "drbg_pr_sha256", 0, 0);
1335                 if (err) {
1336                         pr_err("DRBG: periodical self test failed\n");
1337                         /*
1338                          * uninstantiate implies that from now on, only errors
1339                          * are returned when reusing this DRBG cipher handle
1340                          */
1341                         drbg_uninstantiate(drbg);
1342                         return 0;
1343                 } else {
1344                         pr_devel("DRBG: self test successful\n");
1345                 }
1346         }
1347 #endif
1348
1349         /*
1350          * All operations were successful, return 0 as mandated by
1351          * the kernel crypto API interface.
1352          */
1353         len = 0;
1354 err:
1355         return len;
1356 }
1357
1358 /*
1359  * Wrapper around drbg_generate which can pull arbitrary long strings
1360  * from the DRBG without hitting the maximum request limitation.
1361  *
1362  * Parameters: see drbg_generate
1363  * Return codes: see drbg_generate -- if one drbg_generate request fails,
1364  *               the entire drbg_generate_long request fails
1365  */
1366 static int drbg_generate_long(struct drbg_state *drbg,
1367                               unsigned char *buf, unsigned int buflen,
1368                               struct drbg_string *addtl)
1369 {
1370         unsigned int len = 0;
1371         unsigned int slice = 0;
1372         do {
1373                 int err = 0;
1374                 unsigned int chunk = 0;
1375                 slice = ((buflen - len) / drbg_max_request_bytes(drbg));
1376                 chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
1377                 mutex_lock(&drbg->drbg_mutex);
1378                 err = drbg_generate(drbg, buf + len, chunk, addtl);
1379                 mutex_unlock(&drbg->drbg_mutex);
1380                 if (0 > err)
1381                         return err;
1382                 len += chunk;
1383         } while (slice > 0 && (len < buflen));
1384         return 0;
1385 }
1386
1387 static void drbg_schedule_async_seed(struct random_ready_callback *rdy)
1388 {
1389         struct drbg_state *drbg = container_of(rdy, struct drbg_state,
1390                                                random_ready);
1391
1392         schedule_work(&drbg->seed_work);
1393 }
1394
1395 static int drbg_prepare_hrng(struct drbg_state *drbg)
1396 {
1397         int err;
1398
1399         /* We do not need an HRNG in test mode. */
1400         if (list_empty(&drbg->test_data.list))
1401                 return 0;
1402
1403         INIT_WORK(&drbg->seed_work, drbg_async_seed);
1404
1405         drbg->random_ready.owner = THIS_MODULE;
1406         drbg->random_ready.func = drbg_schedule_async_seed;
1407
1408         err = add_random_ready_callback(&drbg->random_ready);
1409
1410         switch (err) {
1411         case 0:
1412                 break;
1413
1414         case -EALREADY:
1415                 err = 0;
1416                 /* fall through */
1417
1418         default:
1419                 drbg->random_ready.func = NULL;
1420                 return err;
1421         }
1422
1423         drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
1424
1425         /*
1426          * Require frequent reseeds until the seed source is fully
1427          * initialized.
1428          */
1429         drbg->reseed_threshold = 50;
1430
1431         return err;
1432 }
1433
1434 /*
1435  * DRBG instantiation function as required by SP800-90A - this function
1436  * sets up the DRBG handle, performs the initial seeding and all sanity
1437  * checks required by SP800-90A
1438  *
1439  * @drbg memory of state -- if NULL, new memory is allocated
1440  * @pers Personalization string that is mixed into state, may be NULL -- note
1441  *       the entropy is pulled by the DRBG internally unconditionally
1442  *       as defined in SP800-90A. The additional input is mixed into
1443  *       the state in addition to the pulled entropy.
1444  * @coreref reference to core
1445  * @pr prediction resistance enabled
1446  *
1447  * return
1448  *      0 on success
1449  *      error value otherwise
1450  */
1451 static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
1452                             int coreref, bool pr)
1453 {
1454         int ret;
1455         bool reseed = true;
1456
1457         pr_devel("DRBG: Initializing DRBG core %d with prediction resistance "
1458                  "%s\n", coreref, pr ? "enabled" : "disabled");
1459         mutex_lock(&drbg->drbg_mutex);
1460
1461         /* 9.1 step 1 is implicit with the selected DRBG type */
1462
1463         /*
1464          * 9.1 step 2 is implicit as caller can select prediction resistance
1465          * and the flag is copied into drbg->flags --
1466          * all DRBG types support prediction resistance
1467          */
1468
1469         /* 9.1 step 4 is implicit in  drbg_sec_strength */
1470
1471         if (!drbg->core) {
1472                 drbg->core = &drbg_cores[coreref];
1473                 drbg->pr = pr;
1474                 drbg->seeded = false;
1475                 drbg->reseed_threshold = drbg_max_requests(drbg);
1476
1477                 ret = drbg_alloc_state(drbg);
1478                 if (ret)
1479                         goto unlock;
1480
1481                 ret = -EFAULT;
1482                 if (drbg->d_ops->crypto_init(drbg))
1483                         goto err;
1484
1485                 ret = drbg_prepare_hrng(drbg);
1486                 if (ret)
1487                         goto free_everything;
1488
1489                 if (IS_ERR(drbg->jent)) {
1490                         ret = PTR_ERR(drbg->jent);
1491                         drbg->jent = NULL;
1492                         if (fips_enabled || ret != -ENOENT)
1493                                 goto free_everything;
1494                         pr_info("DRBG: Continuing without Jitter RNG\n");
1495                 }
1496
1497                 reseed = false;
1498         }
1499
1500         ret = drbg_seed(drbg, pers, reseed);
1501
1502         if (ret && !reseed)
1503                 goto free_everything;
1504
1505         mutex_unlock(&drbg->drbg_mutex);
1506         return ret;
1507
1508 err:
1509         drbg_dealloc_state(drbg);
1510 unlock:
1511         mutex_unlock(&drbg->drbg_mutex);
1512         return ret;
1513
1514 free_everything:
1515         mutex_unlock(&drbg->drbg_mutex);
1516         drbg_uninstantiate(drbg);
1517         return ret;
1518 }
1519
1520 /*
1521  * DRBG uninstantiate function as required by SP800-90A - this function
1522  * frees all buffers and the DRBG handle
1523  *
1524  * @drbg DRBG state handle
1525  *
1526  * return
1527  *      0 on success
1528  */
1529 static int drbg_uninstantiate(struct drbg_state *drbg)
1530 {
1531         if (drbg->random_ready.func) {
1532                 del_random_ready_callback(&drbg->random_ready);
1533                 cancel_work_sync(&drbg->seed_work);
1534                 crypto_free_rng(drbg->jent);
1535                 drbg->jent = NULL;
1536         }
1537
1538         if (drbg->d_ops)
1539                 drbg->d_ops->crypto_fini(drbg);
1540         drbg_dealloc_state(drbg);
1541         /* no scrubbing of test_data -- this shall survive an uninstantiate */
1542         return 0;
1543 }
1544
1545 /*
1546  * Helper function for setting the test data in the DRBG
1547  *
1548  * @drbg DRBG state handle
1549  * @data test data
1550  * @len test data length
1551  */
1552 static void drbg_kcapi_set_entropy(struct crypto_rng *tfm,
1553                                    const u8 *data, unsigned int len)
1554 {
1555         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1556
1557         mutex_lock(&drbg->drbg_mutex);
1558         drbg_string_fill(&drbg->test_data, data, len);
1559         mutex_unlock(&drbg->drbg_mutex);
1560 }
1561
1562 /***************************************************************
1563  * Kernel crypto API cipher invocations requested by DRBG
1564  ***************************************************************/
1565
1566 #if defined(CONFIG_CRYPTO_DRBG_HASH) || defined(CONFIG_CRYPTO_DRBG_HMAC)
1567 struct sdesc {
1568         struct shash_desc shash;
1569         char ctx[];
1570 };
1571
1572 static int drbg_init_hash_kernel(struct drbg_state *drbg)
1573 {
1574         struct sdesc *sdesc;
1575         struct crypto_shash *tfm;
1576
1577         tfm = crypto_alloc_shash(drbg->core->backend_cra_name, 0, 0);
1578         if (IS_ERR(tfm)) {
1579                 pr_info("DRBG: could not allocate digest TFM handle: %s\n",
1580                                 drbg->core->backend_cra_name);
1581                 return PTR_ERR(tfm);
1582         }
1583         BUG_ON(drbg_blocklen(drbg) != crypto_shash_digestsize(tfm));
1584         sdesc = kzalloc(sizeof(struct shash_desc) + crypto_shash_descsize(tfm),
1585                         GFP_KERNEL);
1586         if (!sdesc) {
1587                 crypto_free_shash(tfm);
1588                 return -ENOMEM;
1589         }
1590
1591         sdesc->shash.tfm = tfm;
1592         sdesc->shash.flags = 0;
1593         drbg->priv_data = sdesc;
1594         return 0;
1595 }
1596
1597 static int drbg_fini_hash_kernel(struct drbg_state *drbg)
1598 {
1599         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1600         if (sdesc) {
1601                 crypto_free_shash(sdesc->shash.tfm);
1602                 kzfree(sdesc);
1603         }
1604         drbg->priv_data = NULL;
1605         return 0;
1606 }
1607
1608 static void drbg_kcapi_hmacsetkey(struct drbg_state *drbg,
1609                                   const unsigned char *key)
1610 {
1611         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1612
1613         crypto_shash_setkey(sdesc->shash.tfm, key, drbg_statelen(drbg));
1614 }
1615
1616 static int drbg_kcapi_hash(struct drbg_state *drbg, unsigned char *outval,
1617                            const struct list_head *in)
1618 {
1619         struct sdesc *sdesc = (struct sdesc *)drbg->priv_data;
1620         struct drbg_string *input = NULL;
1621
1622         crypto_shash_init(&sdesc->shash);
1623         list_for_each_entry(input, in, list)
1624                 crypto_shash_update(&sdesc->shash, input->buf, input->len);
1625         return crypto_shash_final(&sdesc->shash, outval);
1626 }
1627 #endif /* (CONFIG_CRYPTO_DRBG_HASH || CONFIG_CRYPTO_DRBG_HMAC) */
1628
1629 #ifdef CONFIG_CRYPTO_DRBG_CTR
1630 static int drbg_init_sym_kernel(struct drbg_state *drbg)
1631 {
1632         int ret = 0;
1633         struct crypto_cipher *tfm;
1634
1635         tfm = crypto_alloc_cipher(drbg->core->backend_cra_name, 0, 0);
1636         if (IS_ERR(tfm)) {
1637                 pr_info("DRBG: could not allocate cipher TFM handle: %s\n",
1638                                 drbg->core->backend_cra_name);
1639                 return PTR_ERR(tfm);
1640         }
1641         BUG_ON(drbg_blocklen(drbg) != crypto_cipher_blocksize(tfm));
1642         drbg->priv_data = tfm;
1643         return ret;
1644 }
1645
1646 static int drbg_fini_sym_kernel(struct drbg_state *drbg)
1647 {
1648         struct crypto_cipher *tfm =
1649                 (struct crypto_cipher *)drbg->priv_data;
1650         if (tfm)
1651                 crypto_free_cipher(tfm);
1652         drbg->priv_data = NULL;
1653         return 0;
1654 }
1655
1656 static int drbg_kcapi_sym(struct drbg_state *drbg, const unsigned char *key,
1657                           unsigned char *outval, const struct drbg_string *in)
1658 {
1659         struct crypto_cipher *tfm =
1660                 (struct crypto_cipher *)drbg->priv_data;
1661
1662         crypto_cipher_setkey(tfm, key, (drbg_keylen(drbg)));
1663         /* there is only component in *in */
1664         BUG_ON(in->len < drbg_blocklen(drbg));
1665         crypto_cipher_encrypt_one(tfm, outval, in->buf);
1666         return 0;
1667 }
1668 #endif /* CONFIG_CRYPTO_DRBG_CTR */
1669
1670 /***************************************************************
1671  * Kernel crypto API interface to register DRBG
1672  ***************************************************************/
1673
1674 /*
1675  * Look up the DRBG flags by given kernel crypto API cra_name
1676  * The code uses the drbg_cores definition to do this
1677  *
1678  * @cra_name kernel crypto API cra_name
1679  * @coreref reference to integer which is filled with the pointer to
1680  *  the applicable core
1681  * @pr reference for setting prediction resistance
1682  *
1683  * return: flags
1684  */
1685 static inline void drbg_convert_tfm_core(const char *cra_driver_name,
1686                                          int *coreref, bool *pr)
1687 {
1688         int i = 0;
1689         size_t start = 0;
1690         int len = 0;
1691
1692         *pr = true;
1693         /* disassemble the names */
1694         if (!memcmp(cra_driver_name, "drbg_nopr_", 10)) {
1695                 start = 10;
1696                 *pr = false;
1697         } else if (!memcmp(cra_driver_name, "drbg_pr_", 8)) {
1698                 start = 8;
1699         } else {
1700                 return;
1701         }
1702
1703         /* remove the first part */
1704         len = strlen(cra_driver_name) - start;
1705         for (i = 0; ARRAY_SIZE(drbg_cores) > i; i++) {
1706                 if (!memcmp(cra_driver_name + start, drbg_cores[i].cra_name,
1707                             len)) {
1708                         *coreref = i;
1709                         return;
1710                 }
1711         }
1712 }
1713
1714 static int drbg_kcapi_init(struct crypto_tfm *tfm)
1715 {
1716         struct drbg_state *drbg = crypto_tfm_ctx(tfm);
1717
1718         mutex_init(&drbg->drbg_mutex);
1719
1720         return 0;
1721 }
1722
1723 static void drbg_kcapi_cleanup(struct crypto_tfm *tfm)
1724 {
1725         drbg_uninstantiate(crypto_tfm_ctx(tfm));
1726 }
1727
1728 /*
1729  * Generate random numbers invoked by the kernel crypto API:
1730  * The API of the kernel crypto API is extended as follows:
1731  *
1732  * src is additional input supplied to the RNG.
1733  * slen is the length of src.
1734  * dst is the output buffer where random data is to be stored.
1735  * dlen is the length of dst.
1736  */
1737 static int drbg_kcapi_random(struct crypto_rng *tfm,
1738                              const u8 *src, unsigned int slen,
1739                              u8 *dst, unsigned int dlen)
1740 {
1741         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1742         struct drbg_string *addtl = NULL;
1743         struct drbg_string string;
1744
1745         if (slen) {
1746                 /* linked list variable is now local to allow modification */
1747                 drbg_string_fill(&string, src, slen);
1748                 addtl = &string;
1749         }
1750
1751         return drbg_generate_long(drbg, dst, dlen, addtl);
1752 }
1753
1754 /*
1755  * Seed the DRBG invoked by the kernel crypto API
1756  */
1757 static int drbg_kcapi_seed(struct crypto_rng *tfm,
1758                            const u8 *seed, unsigned int slen)
1759 {
1760         struct drbg_state *drbg = crypto_rng_ctx(tfm);
1761         struct crypto_tfm *tfm_base = crypto_rng_tfm(tfm);
1762         bool pr = false;
1763         struct drbg_string string;
1764         struct drbg_string *seed_string = NULL;
1765         int coreref = 0;
1766
1767         drbg_convert_tfm_core(crypto_tfm_alg_driver_name(tfm_base), &coreref,
1768                               &pr);
1769         if (0 < slen) {
1770                 drbg_string_fill(&string, seed, slen);
1771                 seed_string = &string;
1772         }
1773
1774         return drbg_instantiate(drbg, seed_string, coreref, pr);
1775 }
1776
1777 /***************************************************************
1778  * Kernel module: code to load the module
1779  ***************************************************************/
1780
1781 /*
1782  * Tests as defined in 11.3.2 in addition to the cipher tests: testing
1783  * of the error handling.
1784  *
1785  * Note: testing of failing seed source as defined in 11.3.2 is not applicable
1786  * as seed source of get_random_bytes does not fail.
1787  *
1788  * Note 2: There is no sensible way of testing the reseed counter
1789  * enforcement, so skip it.
1790  */
1791 static inline int __init drbg_healthcheck_sanity(void)
1792 {
1793         int len = 0;
1794 #define OUTBUFLEN 16
1795         unsigned char buf[OUTBUFLEN];
1796         struct drbg_state *drbg = NULL;
1797         int ret = -EFAULT;
1798         int rc = -EFAULT;
1799         bool pr = false;
1800         int coreref = 0;
1801         struct drbg_string addtl;
1802         size_t max_addtllen, max_request_bytes;
1803
1804         /* only perform test in FIPS mode */
1805         if (!fips_enabled)
1806                 return 0;
1807
1808 #ifdef CONFIG_CRYPTO_DRBG_CTR
1809         drbg_convert_tfm_core("drbg_nopr_ctr_aes128", &coreref, &pr);
1810 #elif defined CONFIG_CRYPTO_DRBG_HASH
1811         drbg_convert_tfm_core("drbg_nopr_sha256", &coreref, &pr);
1812 #else
1813         drbg_convert_tfm_core("drbg_nopr_hmac_sha256", &coreref, &pr);
1814 #endif
1815
1816         drbg = kzalloc(sizeof(struct drbg_state), GFP_KERNEL);
1817         if (!drbg)
1818                 return -ENOMEM;
1819
1820         mutex_init(&drbg->drbg_mutex);
1821
1822         /*
1823          * if the following tests fail, it is likely that there is a buffer
1824          * overflow as buf is much smaller than the requested or provided
1825          * string lengths -- in case the error handling does not succeed
1826          * we may get an OOPS. And we want to get an OOPS as this is a
1827          * grave bug.
1828          */
1829
1830         /* get a valid instance of DRBG for following tests */
1831         ret = drbg_instantiate(drbg, NULL, coreref, pr);
1832         if (ret) {
1833                 rc = ret;
1834                 goto outbuf;
1835         }
1836         max_addtllen = drbg_max_addtl(drbg);
1837         max_request_bytes = drbg_max_request_bytes(drbg);
1838         drbg_string_fill(&addtl, buf, max_addtllen + 1);
1839         /* overflow addtllen with additonal info string */
1840         len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl);
1841         BUG_ON(0 < len);
1842         /* overflow max_bits */
1843         len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL);
1844         BUG_ON(0 < len);
1845         drbg_uninstantiate(drbg);
1846
1847         /* overflow max addtllen with personalization string */
1848         ret = drbg_instantiate(drbg, &addtl, coreref, pr);
1849         BUG_ON(0 == ret);
1850         /* all tests passed */
1851         rc = 0;
1852
1853         pr_devel("DRBG: Sanity tests for failure code paths successfully "
1854                  "completed\n");
1855
1856         drbg_uninstantiate(drbg);
1857 outbuf:
1858         kzfree(drbg);
1859         return rc;
1860 }
1861
1862 static struct rng_alg drbg_algs[22];
1863
1864 /*
1865  * Fill the array drbg_algs used to register the different DRBGs
1866  * with the kernel crypto API. To fill the array, the information
1867  * from drbg_cores[] is used.
1868  */
1869 static inline void __init drbg_fill_array(struct rng_alg *alg,
1870                                           const struct drbg_core *core, int pr)
1871 {
1872         int pos = 0;
1873         static int priority = 200;
1874
1875         memcpy(alg->base.cra_name, "stdrng", 6);
1876         if (pr) {
1877                 memcpy(alg->base.cra_driver_name, "drbg_pr_", 8);
1878                 pos = 8;
1879         } else {
1880                 memcpy(alg->base.cra_driver_name, "drbg_nopr_", 10);
1881                 pos = 10;
1882         }
1883         memcpy(alg->base.cra_driver_name + pos, core->cra_name,
1884                strlen(core->cra_name));
1885
1886         alg->base.cra_priority = priority;
1887         priority++;
1888         /*
1889          * If FIPS mode enabled, the selected DRBG shall have the
1890          * highest cra_priority over other stdrng instances to ensure
1891          * it is selected.
1892          */
1893         if (fips_enabled)
1894                 alg->base.cra_priority += 200;
1895
1896         alg->base.cra_ctxsize   = sizeof(struct drbg_state);
1897         alg->base.cra_module    = THIS_MODULE;
1898         alg->base.cra_init      = drbg_kcapi_init;
1899         alg->base.cra_exit      = drbg_kcapi_cleanup;
1900         alg->generate           = drbg_kcapi_random;
1901         alg->seed               = drbg_kcapi_seed;
1902         alg->set_ent            = drbg_kcapi_set_entropy;
1903         alg->seedsize           = 0;
1904 }
1905
1906 static int __init drbg_init(void)
1907 {
1908         unsigned int i = 0; /* pointer to drbg_algs */
1909         unsigned int j = 0; /* pointer to drbg_cores */
1910         int ret = -EFAULT;
1911
1912         ret = drbg_healthcheck_sanity();
1913         if (ret)
1914                 return ret;
1915
1916         if (ARRAY_SIZE(drbg_cores) * 2 > ARRAY_SIZE(drbg_algs)) {
1917                 pr_info("DRBG: Cannot register all DRBG types"
1918                         "(slots needed: %zu, slots available: %zu)\n",
1919                         ARRAY_SIZE(drbg_cores) * 2, ARRAY_SIZE(drbg_algs));
1920                 return ret;
1921         }
1922
1923         /*
1924          * each DRBG definition can be used with PR and without PR, thus
1925          * we instantiate each DRBG in drbg_cores[] twice.
1926          *
1927          * As the order of placing them into the drbg_algs array matters
1928          * (the later DRBGs receive a higher cra_priority) we register the
1929          * prediction resistance DRBGs first as the should not be too
1930          * interesting.
1931          */
1932         for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
1933                 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 1);
1934         for (j = 0; ARRAY_SIZE(drbg_cores) > j; j++, i++)
1935                 drbg_fill_array(&drbg_algs[i], &drbg_cores[j], 0);
1936         return crypto_register_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
1937 }
1938
1939 static void __exit drbg_exit(void)
1940 {
1941         crypto_unregister_rngs(drbg_algs, (ARRAY_SIZE(drbg_cores) * 2));
1942 }
1943
1944 module_init(drbg_init);
1945 module_exit(drbg_exit);
1946 #ifndef CRYPTO_DRBG_HASH_STRING
1947 #define CRYPTO_DRBG_HASH_STRING ""
1948 #endif
1949 #ifndef CRYPTO_DRBG_HMAC_STRING
1950 #define CRYPTO_DRBG_HMAC_STRING ""
1951 #endif
1952 #ifndef CRYPTO_DRBG_CTR_STRING
1953 #define CRYPTO_DRBG_CTR_STRING ""
1954 #endif
1955 MODULE_LICENSE("GPL");
1956 MODULE_AUTHOR("Stephan Mueller <[email protected]>");
1957 MODULE_DESCRIPTION("NIST SP800-90A Deterministic Random Bit Generator (DRBG) "
1958                    "using following cores: "
1959                    CRYPTO_DRBG_HASH_STRING
1960                    CRYPTO_DRBG_HMAC_STRING
1961                    CRYPTO_DRBG_CTR_STRING);
1962 MODULE_ALIAS_CRYPTO("stdrng");