| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20081201071903.GS476@secunet.com>
Date: Mon, 1 Dec 2008 08:19:03 +0100
From: Steffen Klassert <steffen.klassert@...unet.com>
To: netdev@...r.kernel.org
Cc: davem@...emloft.net, herbert@...dor.apana.org.au,
klassert@...hematik.tu-chemnitz.de
Subject: [RFC PATCH 3/5] crypto: add possibility to force sync transform
From: Steffen Klassert <steffen.klassert@...unet.com>
If IPsec is parallelized by xfrm_padata, async transform
is not allowed. So Add a possibility to force sync
transform in this case.
Signed-off-by: Steffen Klassert <steffen.klassert@...unet.com>
---
crypto/chainiv.c | 14 ++++++++++++--
net/ipv4/esp4.c | 12 ++++++++++--
net/ipv6/esp6.c | 12 ++++++++++--
3 files changed, 32 insertions(+), 6 deletions(-)
diff --git a/crypto/chainiv.c b/crypto/chainiv.c
index 7c37a49..2079fdd 100644
--- a/crypto/chainiv.c
+++ b/crypto/chainiv.c
@@ -168,8 +168,12 @@ static int async_chainiv_givencrypt_tail(struct skcipher_givcrypt_request *req)
memcpy(subreq->info, ctx->iv, ivsize);
ctx->err = crypto_ablkcipher_encrypt(subreq);
- if (ctx->err)
- goto out;
+ if (ctx->err) {
+ if (ablkcipher_request_flags(&req->creq) & CRYPTO_TFM_REQ_FORCE_SYNC)
+ return ctx->err;
+ else
+ goto out;
+ }
memcpy(ctx->iv, subreq->info, ivsize);
@@ -190,6 +194,11 @@ static int async_chainiv_givencrypt(struct skcipher_givcrypt_request *req)
ablkcipher_request_set_crypt(subreq, req->creq.src, req->creq.dst,
req->creq.nbytes, req->creq.info);
+ if (ablkcipher_request_flags(&req->creq) & CRYPTO_TFM_REQ_FORCE_SYNC) {
+ clear_bit(CHAINIV_STATE_INUSE, &ctx->state);
+ goto sync_out;
+ }
+
if (test_and_set_bit(CHAINIV_STATE_INUSE, &ctx->state))
goto postpone;
@@ -198,6 +207,7 @@ static int async_chainiv_givencrypt(struct skcipher_givcrypt_request *req)
goto postpone;
}
+sync_out:
return async_chainiv_givencrypt_tail(req);
postpone:
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 21515d4..3ea3fb2 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -114,6 +114,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
void *tmp;
u8 *iv;
u8 *tail;
+ u32 flags;
int blksize;
int clen;
int alen;
@@ -123,6 +124,8 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
err = -ENOMEM;
+ flags = 0;
+
/* Round to block size */
clen = skb->len;
@@ -207,7 +210,9 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
clen + alen);
sg_init_one(asg, esph, sizeof(*esph));
- aead_givcrypt_set_callback(req, 0, esp_output_done, skb);
+ xfrm_aead_set_flags(skb, flags);
+
+ aead_givcrypt_set_callback(req, flags, esp_output_done, skb);
aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
aead_givcrypt_set_assoc(req, asg, sizeof(*esph));
aead_givcrypt_set_giv(req, esph->enc_data,
@@ -332,6 +337,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
int nfrags;
void *tmp;
u8 *iv;
+ u32 flags = 0;
struct scatterlist *sg;
struct scatterlist *asg;
int err = -EINVAL;
@@ -368,7 +374,9 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
skb_to_sgvec(skb, sg, sizeof(*esph) + crypto_aead_ivsize(aead), elen);
sg_init_one(asg, esph, sizeof(*esph));
- aead_request_set_callback(req, 0, esp_input_done, skb);
+ xfrm_aead_set_flags(skb, flags);
+
+ aead_request_set_callback(req, flags, esp_input_done, skb);
aead_request_set_crypt(req, sg, sg, elen, iv);
aead_request_set_assoc(req, asg, sizeof(*esph));
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index b181b08..9874adf 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -143,11 +143,14 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
int nfrags;
u8 *iv;
u8 *tail;
+ u32 flags;
struct esp_data *esp = x->data;
/* skb is pure payload to encrypt */
err = -ENOMEM;
+ flags = 0;
+
/* Round to block size */
clen = skb->len;
@@ -196,7 +199,9 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
clen + alen);
sg_init_one(asg, esph, sizeof(*esph));
- aead_givcrypt_set_callback(req, 0, esp_output_done, skb);
+ xfrm_aead_set_flags(skb, flags);
+
+ aead_givcrypt_set_callback(req, flags, esp_output_done, skb);
aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
aead_givcrypt_set_assoc(req, asg, sizeof(*esph));
aead_givcrypt_set_giv(req, esph->enc_data,
@@ -279,6 +284,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
int ret = 0;
void *tmp;
u8 *iv;
+ u32 flags = 0;
struct scatterlist *sg;
struct scatterlist *asg;
@@ -319,7 +325,9 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
skb_to_sgvec(skb, sg, sizeof(*esph) + crypto_aead_ivsize(aead), elen);
sg_init_one(asg, esph, sizeof(*esph));
- aead_request_set_callback(req, 0, esp_input_done, skb);
+ xfrm_aead_set_flags(skb, flags);
+
+ aead_request_set_callback(req, flags, esp_input_done, skb);
aead_request_set_crypt(req, sg, sg, elen, iv);
aead_request_set_assoc(req, asg, sizeof(*esph));
--
1.5.4.2
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists