crypto/seqiv.c

   1 /*
   2  * seqiv: Sequence Number IV Generator
   3  *
   4  * This generator generates an IV based on a sequence number by xoring it
   5  * with a salt.  This algorithm is mainly useful for CTR and similar modes.
   6  *
   7  * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
   8  *
   9  * This program is free software; you can redistribute it and/or modify it
  10  * under the terms of the GNU General Public License as published by the Free
  11  * Software Foundation; either version 2 of the License, or (at your option)
  12  * any later version.
  13  *
  14  */
  15
  16 #include <crypto/internal/aead.h>
  17 #include <crypto/internal/skcipher.h>
  18 #include <crypto/null.h>
  19 #include <crypto/rng.h>
  20 #include <crypto/scatterwalk.h>
  21 #include <linux/err.h>
  22 #include <linux/init.h>
  23 #include <linux/kernel.h>
  24 #include <linux/module.h>
  25 #include <linux/slab.h>
  26 #include <linux/spinlock.h>
  27 #include <linux/string.h>
  28
  29 struct seqniv_request_ctx {
  30         struct scatterlist dst[2];
  31         struct aead_request subreq;
  32 };
  33
  34 struct seqiv_ctx {
  35         spinlock_t lock;
  36         u8 salt[] __attribute__ ((aligned(__alignof__(u32))));
  37 };
  38
  39 struct seqiv_aead_ctx {
  40         struct crypto_aead *child;
  41         spinlock_t lock;
  42         struct crypto_blkcipher *null;
  43         u8 salt[] __attribute__ ((aligned(__alignof__(u32))));
  44 };
  45
  46 static void seqiv_free(struct crypto_instance *inst);
  47
  48 static int seqiv_aead_setkey(struct crypto_aead *tfm,
  49                              const u8 *key, unsigned int keylen)
  50 {
  51         struct seqiv_aead_ctx *ctx = crypto_aead_ctx(tfm);
  52
  53         return crypto_aead_setkey(ctx->child, key, keylen);
  54 }
  55
  56 static int seqiv_aead_setauthsize(struct crypto_aead *tfm,
  57                                   unsigned int authsize)
  58 {
  59         struct seqiv_aead_ctx *ctx = crypto_aead_ctx(tfm);
  60
  61         return crypto_aead_setauthsize(ctx->child, authsize);
  62 }
  63
  64 static void seqiv_complete2(struct skcipher_givcrypt_request *req, int err)
  65 {
  66         struct ablkcipher_request *subreq = skcipher_givcrypt_reqctx(req);
  67         struct crypto_ablkcipher *geniv;
  68
  69         if (err == -EINPROGRESS)
  70                 return;
  71
  72         if (err)
  73                 goto out;
  74
  75         geniv = skcipher_givcrypt_reqtfm(req);
  76         memcpy(req->creq.info, subreq->info, crypto_ablkcipher_ivsize(geniv));
  77
  78 out:
  79         kfree(subreq->info);
  80 }
  81
  82 static void seqiv_complete(struct crypto_async_request *base, int err)
  83 {
  84         struct skcipher_givcrypt_request *req = base->data;
  85
  86         seqiv_complete2(req, err);
  87         skcipher_givcrypt_complete(req, err);
  88 }
  89
  90 static void seqiv_aead_complete2(struct aead_givcrypt_request *req, int err)
  91 {
  92         struct aead_request *subreq = aead_givcrypt_reqctx(req);
  93         struct crypto_aead *geniv;
  94
  95         if (err == -EINPROGRESS)
  96                 return;
  97
  98         if (err)
  99                 goto out;
 100
 101         geniv = aead_givcrypt_reqtfm(req);
 102         memcpy(req->areq.iv, subreq->iv, crypto_aead_ivsize(geniv));
 103
 104 out:
 105         kfree(subreq->iv);
 106 }
 107
 108 static void seqiv_aead_complete(struct crypto_async_request *base, int err)
 109 {
 110         struct aead_givcrypt_request *req = base->data;
 111
 112         seqiv_aead_complete2(req, err);
 113         aead_givcrypt_complete(req, err);
 114 }
 115
 116 static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err)
 117 {
 118         struct aead_request *subreq = aead_request_ctx(req);
 119         struct crypto_aead *geniv;
 120
 121         if (err == -EINPROGRESS)
 122                 return;
 123
 124         if (err)
 125                 goto out;
 126
 127         geniv = crypto_aead_reqtfm(req);
 128         memcpy(req->iv, subreq->iv, crypto_aead_ivsize(geniv));
 129
 130 out:
 131         kzfree(subreq->iv);
 132 }
 133
 134 static void seqiv_aead_encrypt_complete(struct crypto_async_request *base,
 135                                         int err)
 136 {
 137         struct aead_request *req = base->data;
 138
 139         seqiv_aead_encrypt_complete2(req, err);
 140         aead_request_complete(req, err);
 141 }
 142
 143 static void seqniv_aead_encrypt_complete2(struct aead_request *req, int err)
 144 {
 145         unsigned int ivsize = 8;
 146         u8 data[20];
 147
 148         if (err == -EINPROGRESS)
 149                 return;
 150
 151         /* Swap IV and ESP header back to correct order. */
 152         scatterwalk_map_and_copy(data, req->dst, 0, req->assoclen + ivsize, 0);
 153         scatterwalk_map_and_copy(data + ivsize, req->dst, 0, req->assoclen, 1);
 154         scatterwalk_map_and_copy(data, req->dst, req->assoclen, ivsize, 1);
 155 }
 156
 157 static void seqniv_aead_encrypt_complete(struct crypto_async_request *base,
 158                                         int err)
 159 {
 160         struct aead_request *req = base->data;
 161
 162         seqniv_aead_encrypt_complete2(req, err);
 163         aead_request_complete(req, err);
 164 }
 165
 166 static void seqniv_aead_decrypt_complete2(struct aead_request *req, int err)
 167 {
 168         u8 data[4];
 169
 170         if (err == -EINPROGRESS)
 171                 return;
 172
 173         /* Move ESP header back to correct location. */
 174         scatterwalk_map_and_copy(data, req->dst, 16, req->assoclen - 8, 0);
 175         scatterwalk_map_and_copy(data, req->dst, 8, req->assoclen - 8, 1);
 176 }
 177
 178 static void seqniv_aead_decrypt_complete(struct crypto_async_request *base,
 179                                          int err)
 180 {
 181         struct aead_request *req = base->data;
 182
 183         seqniv_aead_decrypt_complete2(req, err);
 184         aead_request_complete(req, err);
 185 }
 186
 187 static void seqiv_geniv(struct seqiv_ctx *ctx, u8 *info, u64 seq,
 188                         unsigned int ivsize)
 189 {
 190         unsigned int len = ivsize;
 191
 192         if (ivsize > sizeof(u64)) {
 193                 memset(info, 0, ivsize - sizeof(u64));
 194                 len = sizeof(u64);
 195         }
 196         seq = cpu_to_be64(seq);
 197         memcpy(info + ivsize - len, &seq, len);
 198         crypto_xor(info, ctx->salt, ivsize);
 199 }
 200
 201 static int seqiv_givencrypt(struct skcipher_givcrypt_request *req)
 202 {
 203         struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
 204         struct seqiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
 205         struct ablkcipher_request *subreq = skcipher_givcrypt_reqctx(req);
 206         crypto_completion_t compl;
 207         void *data;
 208         u8 *info;
 209         unsigned int ivsize;
 210         int err;
 211
 212         ablkcipher_request_set_tfm(subreq, skcipher_geniv_cipher(geniv));
 213
 214         compl = req->creq.base.complete;
 215         data = req->creq.base.data;
 216         info = req->creq.info;
 217
 218         ivsize = crypto_ablkcipher_ivsize(geniv);
 219
 220         if (unlikely(!IS_ALIGNED((unsigned long)info,
 221                                  crypto_ablkcipher_alignmask(geniv) + 1))) {
 222                 info = kmalloc(ivsize, req->creq.base.flags &
 223                                        CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
 224                                                                   GFP_ATOMIC);
 225                 if (!info)
 226                         return -ENOMEM;
 227
 228                 compl = seqiv_complete;
 229                 data = req;
 230         }
 231
 232         ablkcipher_request_set_callback(subreq, req->creq.base.flags, compl,
 233                                         data);
 234         ablkcipher_request_set_crypt(subreq, req->creq.src, req->creq.dst,
 235                                      req->creq.nbytes, info);
 236
 237         seqiv_geniv(ctx, info, req->seq, ivsize);
 238         memcpy(req->giv, info, ivsize);
 239
 240         err = crypto_ablkcipher_encrypt(subreq);
 241         if (unlikely(info != req->creq.info))
 242                 seqiv_complete2(req, err);
 243         return err;
 244 }
 245
 246 static int seqiv_aead_givencrypt(struct aead_givcrypt_request *req)
 247 {
 248         struct crypto_aead *geniv = aead_givcrypt_reqtfm(req);
 249         struct seqiv_ctx *ctx = crypto_aead_ctx(geniv);
 250         struct aead_request *areq = &req->areq;
 251         struct aead_request *subreq = aead_givcrypt_reqctx(req);
 252         crypto_completion_t compl;
 253         void *data;
 254         u8 *info;
 255         unsigned int ivsize;
 256         int err;
 257
 258         aead_request_set_tfm(subreq, aead_geniv_base(geniv));
 259
 260         compl = areq->base.complete;
 261         data = areq->base.data;
 262         info = areq->iv;
 263
 264         ivsize = crypto_aead_ivsize(geniv);
 265
 266         if (unlikely(!IS_ALIGNED((unsigned long)info,
 267                                  crypto_aead_alignmask(geniv) + 1))) {
 268                 info = kmalloc(ivsize, areq->base.flags &
 269                                        CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
 270                                                                   GFP_ATOMIC);
 271                 if (!info)
 272                         return -ENOMEM;
 273
 274                 compl = seqiv_aead_complete;
 275                 data = req;
 276         }
 277
 278         aead_request_set_callback(subreq, areq->base.flags, compl, data);
 279         aead_request_set_crypt(subreq, areq->src, areq->dst, areq->cryptlen,
 280                                info);
 281         aead_request_set_assoc(subreq, areq->assoc, areq->assoclen);
 282
 283         seqiv_geniv(ctx, info, req->seq, ivsize);
 284         memcpy(req->giv, info, ivsize);
 285
 286         err = crypto_aead_encrypt(subreq);
 287         if (unlikely(info != areq->iv))
 288                 seqiv_aead_complete2(req, err);
 289         return err;
 290 }
 291
 292 static int seqiv_aead_encrypt_compat(struct aead_request *req)
 293 {
 294         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 295         struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
 296         struct seqniv_request_ctx *rctx = aead_request_ctx(req);
 297         struct aead_request *subreq = &rctx->subreq;
 298         struct scatterlist *dst;
 299         crypto_completion_t compl;
 300         void *data;
 301         unsigned int ivsize = 8;
 302         u8 buf[20] __attribute__ ((aligned(__alignof__(u32))));
 303         int err;
 304
 305         if (req->cryptlen < ivsize)
 306                 return -EINVAL;
 307
 308         /* ESP AD is at most 12 bytes (ESN). */
 309         if (req->assoclen > 12)
 310                 return -EINVAL;
 311
 312         aead_request_set_tfm(subreq, ctx->child);
 313
 314         compl = seqniv_aead_encrypt_complete;
 315         data = req;
 316
 317         if (req->src != req->dst) {
 318                 struct scatterlist srcbuf[2];
 319                 struct scatterlist dstbuf[2];
 320                 struct blkcipher_desc desc = {
 321                         .tfm = ctx->null,
 322                 };
 323
 324                 err = crypto_blkcipher_encrypt(
 325                         &desc,
 326                         scatterwalk_ffwd(dstbuf, req->dst,
 327                                          req->assoclen + ivsize),
 328                         scatterwalk_ffwd(srcbuf, req->src,
 329                                          req->assoclen + ivsize),
 330                         req->cryptlen - ivsize);
 331                 if (err)
 332                         return err;
 333         }
 334
 335         dst = scatterwalk_ffwd(rctx->dst, req->dst, ivsize);
 336
 337         aead_request_set_callback(subreq, req->base.flags, compl, data);
 338         aead_request_set_crypt(subreq, dst, dst,
 339                                req->cryptlen - ivsize, req->iv);
 340         aead_request_set_ad(subreq, req->assoclen);
 341
 342         memcpy(buf, req->iv, ivsize);
 343         crypto_xor(buf, ctx->salt, ivsize);
 344         memcpy(req->iv, buf, ivsize);
 345
 346         /* Swap order of IV and ESP AD for ICV generation. */
 347         scatterwalk_map_and_copy(buf + ivsize, req->dst, 0, req->assoclen, 0);
 348         scatterwalk_map_and_copy(buf, req->dst, 0, req->assoclen + ivsize, 1);
 349
 350         err = crypto_aead_encrypt(subreq);
 351         seqniv_aead_encrypt_complete2(req, err);
 352         return err;
 353 }
 354
 355 static int seqiv_aead_encrypt(struct aead_request *req)
 356 {
 357         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 358         struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
 359         struct aead_request *subreq = aead_request_ctx(req);
 360         crypto_completion_t compl;
 361         void *data;
 362         u8 *info;
 363         unsigned int ivsize = 8;
 364         int err;
 365
 366         if (req->cryptlen < ivsize)
 367                 return -EINVAL;
 368
 369         aead_request_set_tfm(subreq, ctx->child);
 370
 371         compl = req->base.complete;
 372         data = req->base.data;
 373         info = req->iv;
 374
 375         if (req->src != req->dst) {
 376                 struct scatterlist src[2];
 377                 struct scatterlist dst[2];
 378                 struct blkcipher_desc desc = {
 379                         .tfm = ctx->null,
 380                 };
 381
 382                 err = crypto_blkcipher_encrypt(
 383                         &desc,
 384                         scatterwalk_ffwd(dst, req->dst,
 385                                          req->assoclen + ivsize),
 386                         scatterwalk_ffwd(src, req->src,
 387                                          req->assoclen + ivsize),
 388                         req->cryptlen - ivsize);
 389                 if (err)
 390                         return err;
 391         }
 392
 393         if (unlikely(!IS_ALIGNED((unsigned long)info,
 394                                  crypto_aead_alignmask(geniv) + 1))) {
 395                 info = kmalloc(ivsize, req->base.flags &
 396                                        CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
 397                                                                   GFP_ATOMIC);
 398                 if (!info)
 399                         return -ENOMEM;
 400
 401                 memcpy(info, req->iv, ivsize);
 402                 compl = seqiv_aead_encrypt_complete;
 403                 data = req;
 404         }
 405
 406         aead_request_set_callback(subreq, req->base.flags, compl, data);
 407         aead_request_set_crypt(subreq, req->dst, req->dst,
 408                                req->cryptlen - ivsize, info);
 409         aead_request_set_ad(subreq, req->assoclen + ivsize);
 410
 411         crypto_xor(info, ctx->salt, ivsize);
 412         scatterwalk_map_and_copy(info, req->dst, req->assoclen, ivsize, 1);
 413
 414         err = crypto_aead_encrypt(subreq);
 415         if (unlikely(info != req->iv))
 416                 seqiv_aead_encrypt_complete2(req, err);
 417         return err;
 418 }
 419
 420 static int seqiv_aead_decrypt_compat(struct aead_request *req)
 421 {
 422         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 423         struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
 424         struct seqniv_request_ctx *rctx = aead_request_ctx(req);
 425         struct aead_request *subreq = &rctx->subreq;
 426         struct scatterlist *dst;
 427         crypto_completion_t compl;
 428         void *data;
 429         unsigned int ivsize = 8;
 430         u8 buf[20];
 431         int err;
 432
 433         if (req->cryptlen < ivsize + crypto_aead_authsize(geniv))
 434                 return -EINVAL;
 435
 436         aead_request_set_tfm(subreq, ctx->child);
 437
 438         compl = req->base.complete;
 439         data = req->base.data;
 440
 441         if (req->assoclen > 12)
 442                 return -EINVAL;
 443         else if (req->assoclen > 8) {
 444                 compl = seqniv_aead_decrypt_complete;
 445                 data = req;
 446         }
 447
 448         if (req->src != req->dst) {
 449                 struct scatterlist srcbuf[2];
 450                 struct scatterlist dstbuf[2];
 451                 struct blkcipher_desc desc = {
 452                         .tfm = ctx->null,
 453                 };
 454
 455                 err = crypto_blkcipher_encrypt(
 456                         &desc,
 457                         scatterwalk_ffwd(dstbuf, req->dst,
 458                                          req->assoclen + ivsize),
 459                         scatterwalk_ffwd(srcbuf, req->src,
 460                                          req->assoclen + ivsize),
 461                         req->cryptlen - ivsize);
 462                 if (err)
 463                         return err;
 464         }
 465
 466         /* Move ESP AD forward for ICV generation. */
 467         scatterwalk_map_and_copy(buf, req->dst, 0, req->assoclen + ivsize, 0);
 468         memcpy(req->iv, buf + req->assoclen, ivsize);
 469         scatterwalk_map_and_copy(buf, req->dst, ivsize, req->assoclen, 1);
 470
 471         dst = scatterwalk_ffwd(rctx->dst, req->dst, ivsize);
 472
 473         aead_request_set_callback(subreq, req->base.flags, compl, data);
 474         aead_request_set_crypt(subreq, dst, dst,
 475                                req->cryptlen - ivsize, req->iv);
 476         aead_request_set_ad(subreq, req->assoclen);
 477
 478         err = crypto_aead_decrypt(subreq);
 479         if (req->assoclen > 8)
 480                 seqniv_aead_decrypt_complete2(req, err);
 481         return err;
 482 }
 483
 484 static int seqiv_aead_decrypt(struct aead_request *req)
 485 {
 486         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 487         struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
 488         struct aead_request *subreq = aead_request_ctx(req);
 489         crypto_completion_t compl;
 490         void *data;
 491         unsigned int ivsize = 8;
 492
 493         if (req->cryptlen < ivsize + crypto_aead_authsize(geniv))
 494                 return -EINVAL;
 495
 496         aead_request_set_tfm(subreq, ctx->child);
 497
 498         compl = req->base.complete;
 499         data = req->base.data;
 500
 501         aead_request_set_callback(subreq, req->base.flags, compl, data);
 502         aead_request_set_crypt(subreq, req->src, req->dst,
 503                                req->cryptlen - ivsize, req->iv);
 504         aead_request_set_ad(subreq, req->assoclen + ivsize);
 505
 506         scatterwalk_map_and_copy(req->iv, req->src, req->assoclen, ivsize, 0);
 507         if (req->src != req->dst)
 508                 scatterwalk_map_and_copy(req->iv, req->dst,
 509                                          req->assoclen, ivsize, 1);
 510
 511         return crypto_aead_decrypt(subreq);
 512 }
 513
 514 static int seqiv_givencrypt_first(struct skcipher_givcrypt_request *req)
 515 {
 516         struct crypto_ablkcipher *geniv = skcipher_givcrypt_reqtfm(req);
 517         struct seqiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
 518         int err = 0;
 519
 520         spin_lock_bh(&ctx->lock);
 521         if (crypto_ablkcipher_crt(geniv)->givencrypt != seqiv_givencrypt_first)
 522                 goto unlock;
 523
 524         crypto_ablkcipher_crt(geniv)->givencrypt = seqiv_givencrypt;
 525         err = crypto_rng_get_bytes(crypto_default_rng, ctx->salt,
 526                                    crypto_ablkcipher_ivsize(geniv));
 527
 528 unlock:
 529         spin_unlock_bh(&ctx->lock);
 530
 531         if (err)
 532                 return err;
 533
 534         return seqiv_givencrypt(req);
 535 }
 536
 537 static int seqiv_aead_givencrypt_first(struct aead_givcrypt_request *req)
 538 {
 539         struct crypto_aead *geniv = aead_givcrypt_reqtfm(req);
 540         struct seqiv_ctx *ctx = crypto_aead_ctx(geniv);
 541         int err = 0;
 542
 543         spin_lock_bh(&ctx->lock);
 544         if (crypto_aead_crt(geniv)->givencrypt != seqiv_aead_givencrypt_first)
 545                 goto unlock;
 546
 547         crypto_aead_crt(geniv)->givencrypt = seqiv_aead_givencrypt;
 548         err = crypto_rng_get_bytes(crypto_default_rng, ctx->salt,
 549                                    crypto_aead_ivsize(geniv));
 550
 551 unlock:
 552         spin_unlock_bh(&ctx->lock);
 553
 554         if (err)
 555                 return err;
 556
 557         return seqiv_aead_givencrypt(req);
 558 }
 559
 560 static int seqiv_aead_encrypt_compat_first(struct aead_request *req)
 561 {
 562         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 563         struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
 564         int err = 0;
 565
 566         spin_lock_bh(&ctx->lock);
 567         if (geniv->encrypt != seqiv_aead_encrypt_compat_first)
 568                 goto unlock;
 569
 570         geniv->encrypt = seqiv_aead_encrypt_compat;
 571         err = crypto_rng_get_bytes(crypto_default_rng, ctx->salt,
 572                                    crypto_aead_ivsize(geniv));
 573
 574 unlock:
 575         spin_unlock_bh(&ctx->lock);
 576
 577         if (err)
 578                 return err;
 579
 580         return seqiv_aead_encrypt_compat(req);
 581 }
 582
 583 static int seqiv_aead_encrypt_first(struct aead_request *req)
 584 {
 585         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
 586         struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
 587         int err = 0;
 588
 589         spin_lock_bh(&ctx->lock);
 590         if (geniv->encrypt != seqiv_aead_encrypt_first)
 591                 goto unlock;
 592
 593         geniv->encrypt = seqiv_aead_encrypt;
 594         err = crypto_rng_get_bytes(crypto_default_rng, ctx->salt,
 595                                    crypto_aead_ivsize(geniv));
 596
 597 unlock:
 598         spin_unlock_bh(&ctx->lock);
 599
 600         if (err)
 601                 return err;
 602
 603         return seqiv_aead_encrypt(req);
 604 }
 605
 606 static int seqiv_init(struct crypto_tfm *tfm)
 607 {
 608         struct crypto_ablkcipher *geniv = __crypto_ablkcipher_cast(tfm);
 609         struct seqiv_ctx *ctx = crypto_ablkcipher_ctx(geniv);
 610
 611         spin_lock_init(&ctx->lock);
 612
 613         tfm->crt_ablkcipher.reqsize = sizeof(struct ablkcipher_request);
 614
 615         return skcipher_geniv_init(tfm);
 616 }
 617
 618 static int seqiv_old_aead_init(struct crypto_tfm *tfm)
 619 {
 620         struct crypto_aead *geniv = __crypto_aead_cast(tfm);
 621         struct seqiv_ctx *ctx = crypto_aead_ctx(geniv);
 622
 623         spin_lock_init(&ctx->lock);
 624
 625         crypto_aead_set_reqsize(__crypto_aead_cast(tfm),
 626                                 sizeof(struct aead_request));
 627
 628         return aead_geniv_init(tfm);
 629 }
 630
 631 static int seqiv_aead_init_common(struct crypto_tfm *tfm, unsigned int reqsize)
 632 {
 633         struct crypto_aead *geniv = __crypto_aead_cast(tfm);
 634         struct seqiv_aead_ctx *ctx = crypto_aead_ctx(geniv);
 635         int err;
 636
 637         spin_lock_init(&ctx->lock);
 638
 639         crypto_aead_set_reqsize(geniv, sizeof(struct aead_request));
 640
 641         ctx->null = crypto_get_default_null_skcipher();
 642         err = PTR_ERR(ctx->null);
 643         if (IS_ERR(ctx->null))
 644                 goto out;
 645
 646         err = aead_geniv_init(tfm);
 647         if (err)
 648                 goto drop_null;
 649
 650         ctx->child = geniv->child;
 651         geniv->child = geniv;
 652
 653 out:
 654         return err;
 655
 656 drop_null:
 657         crypto_put_default_null_skcipher();
 658         goto out;
 659 }
 660
 661 static int seqiv_aead_init(struct crypto_tfm *tfm)
 662 {
 663         return seqiv_aead_init_common(tfm, sizeof(struct aead_request));
 664 }
 665
 666 static int seqniv_aead_init(struct crypto_tfm *tfm)
 667 {
 668         return seqiv_aead_init_common(tfm, sizeof(struct seqniv_request_ctx));
 669 }
 670
 671 static void seqiv_aead_exit(struct crypto_tfm *tfm)
 672 {
 673         struct seqiv_aead_ctx *ctx = crypto_tfm_ctx(tfm);
 674
 675         crypto_free_aead(ctx->child);
 676         crypto_put_default_null_skcipher();
 677 }
 678
 679 static int seqiv_ablkcipher_create(struct crypto_template *tmpl,
 680                                    struct rtattr **tb)
 681 {
 682         struct crypto_instance *inst;
 683         int err;
 684
 685         inst = skcipher_geniv_alloc(tmpl, tb, 0, 0);
 686
 687         if (IS_ERR(inst))
 688                 return PTR_ERR(inst);
 689
 690         err = -EINVAL;
 691         if (inst->alg.cra_ablkcipher.ivsize < sizeof(u64))
 692                 goto free_inst;
 693
 694         inst->alg.cra_ablkcipher.givencrypt = seqiv_givencrypt_first;
 695
 696         inst->alg.cra_init = seqiv_init;
 697         inst->alg.cra_exit = skcipher_geniv_exit;
 698
 699         inst->alg.cra_ctxsize += inst->alg.cra_ablkcipher.ivsize;
 700         inst->alg.cra_ctxsize += sizeof(struct seqiv_ctx);
 701
 702         inst->alg.cra_alignmask |= __alignof__(u32) - 1;
 703
 704         err = crypto_register_instance(tmpl, inst);
 705         if (err)
 706                 goto free_inst;
 707
 708 out:
 709         return err;
 710
 711 free_inst:
 712         skcipher_geniv_free(inst);
 713         goto out;
 714 }
 715
 716 static int seqiv_old_aead_create(struct crypto_template *tmpl,
 717                                  struct aead_instance *aead)
 718 {
 719         struct crypto_instance *inst = aead_crypto_instance(aead);
 720         int err = -EINVAL;
 721
 722         if (inst->alg.cra_aead.ivsize < sizeof(u64))
 723                 goto free_inst;
 724
 725         inst->alg.cra_aead.givencrypt = seqiv_aead_givencrypt_first;
 726
 727         inst->alg.cra_init = seqiv_old_aead_init;
 728         inst->alg.cra_exit = aead_geniv_exit;
 729
 730         inst->alg.cra_ctxsize = inst->alg.cra_aead.ivsize;
 731         inst->alg.cra_ctxsize += sizeof(struct seqiv_ctx);
 732
 733         err = crypto_register_instance(tmpl, inst);
 734         if (err)
 735                 goto free_inst;
 736
 737 out:
 738         return err;
 739
 740 free_inst:
 741         aead_geniv_free(aead);
 742         goto out;
 743 }
 744
 745 static int seqiv_aead_create(struct crypto_template *tmpl, struct rtattr **tb)
 746 {
 747         struct aead_instance *inst;
 748         struct crypto_aead_spawn *spawn;
 749         struct aead_alg *alg;
 750         int err;
 751
 752         inst = aead_geniv_alloc(tmpl, tb, 0, 0);
 753
 754         if (IS_ERR(inst))
 755                 return PTR_ERR(inst);
 756
 757         inst->alg.base.cra_alignmask |= __alignof__(u32) - 1;
 758
 759         if (inst->alg.base.cra_aead.encrypt)
 760                 return seqiv_old_aead_create(tmpl, inst);
 761
 762         err = -EINVAL;
 763         if (inst->alg.ivsize != sizeof(u64))
 764                 goto free_inst;
 765
 766         spawn = aead_instance_ctx(inst);
 767         alg = crypto_spawn_aead_alg(spawn);
 768
 769         inst->alg.setkey = seqiv_aead_setkey;
 770         inst->alg.setauthsize = seqiv_aead_setauthsize;
 771         inst->alg.encrypt = seqiv_aead_encrypt_first;
 772         inst->alg.decrypt = seqiv_aead_decrypt;
 773
 774         inst->alg.base.cra_init = seqiv_aead_init;
 775         inst->alg.base.cra_exit = seqiv_aead_exit;
 776
 777         inst->alg.base.cra_ctxsize = sizeof(struct seqiv_aead_ctx);
 778         inst->alg.base.cra_ctxsize += inst->alg.base.cra_aead.ivsize;
 779
 780         if (alg->base.cra_aead.encrypt) {
 781                 inst->alg.encrypt = seqiv_aead_encrypt_compat_first;
 782                 inst->alg.decrypt = seqiv_aead_decrypt_compat;
 783
 784                 inst->alg.base.cra_init = seqniv_aead_init;
 785                 inst->alg.base.cra_exit = seqiv_aead_exit;
 786         }
 787
 788         err = aead_register_instance(tmpl, inst);
 789         if (err)
 790                 goto free_inst;
 791
 792 out:
 793         return err;
 794
 795 free_inst:
 796         aead_geniv_free(inst);
 797         goto out;
 798 }
 799
 800 static int seqiv_create(struct crypto_template *tmpl, struct rtattr **tb)
 801 {
 802         struct crypto_attr_type *algt;
 803         int err;
 804
 805         algt = crypto_get_attr_type(tb);
 806         if (IS_ERR(algt))
 807                 return PTR_ERR(algt);
 808
 809         err = crypto_get_default_rng();
 810         if (err)
 811                 return err;
 812
 813         if ((algt->type ^ CRYPTO_ALG_TYPE_AEAD) & CRYPTO_ALG_TYPE_MASK)
 814                 err = seqiv_ablkcipher_create(tmpl, tb);
 815         else
 816                 err = seqiv_aead_create(tmpl, tb);
 817
 818         if (err)
 819                 crypto_put_default_rng();
 820
 821         return err;
 822 }
 823
 824 static int seqniv_create(struct crypto_template *tmpl, struct rtattr **tb)
 825 {
 826         struct aead_instance *inst;
 827         struct crypto_aead_spawn *spawn;
 828         struct aead_alg *alg;
 829         int err;
 830
 831         err = crypto_get_default_rng();
 832         if (err)
 833                 return err;
 834
 835         inst = aead_geniv_alloc(tmpl, tb, 0, 0);
 836         err = PTR_ERR(inst);
 837         if (IS_ERR(inst))
 838                 goto put_rng;
 839
 840         err = -EINVAL;
 841         if (inst->alg.ivsize != sizeof(u64))
 842                 goto free_inst;
 843
 844         spawn = aead_instance_ctx(inst);
 845         alg = crypto_spawn_aead_alg(spawn);
 846
 847         inst->alg.setkey = seqiv_aead_setkey;
 848         inst->alg.setauthsize = seqiv_aead_setauthsize;
 849         inst->alg.encrypt = seqiv_aead_encrypt_compat_first;
 850         inst->alg.decrypt = seqiv_aead_decrypt_compat;
 851
 852         inst->alg.base.cra_init = seqniv_aead_init;
 853         inst->alg.base.cra_exit = seqiv_aead_exit;
 854
 855         inst->alg.base.cra_alignmask |= __alignof__(u32) - 1;
 856         inst->alg.base.cra_ctxsize = sizeof(struct seqiv_aead_ctx);
 857         inst->alg.base.cra_ctxsize += inst->alg.base.cra_aead.ivsize;
 858
 859         err = aead_register_instance(tmpl, inst);
 860         if (err)
 861                 goto free_inst;
 862
 863 out:
 864         return err;
 865
 866 free_inst:
 867         aead_geniv_free(inst);
 868 put_rng:
 869         crypto_put_default_rng();
 870         goto out;
 871 }
 872
 873 static void seqiv_free(struct crypto_instance *inst)
 874 {
 875         if ((inst->alg.cra_flags ^ CRYPTO_ALG_TYPE_AEAD) & CRYPTO_ALG_TYPE_MASK)
 876                 skcipher_geniv_free(inst);
 877         else
 878                 aead_geniv_free(aead_instance(inst));
 879         crypto_put_default_rng();
 880 }
 881
 882 static struct crypto_template seqiv_tmpl = {
 883         .name = "seqiv",
 884         .create = seqiv_create,
 885         .free = seqiv_free,
 886         .module = THIS_MODULE,
 887 };
 888
 889 static struct crypto_template seqniv_tmpl = {
 890         .name = "seqniv",
 891         .create = seqniv_create,
 892         .free = seqiv_free,
 893         .module = THIS_MODULE,
 894 };
 895
 896 static int __init seqiv_module_init(void)
 897 {
 898         int err;
 899
 900         err = crypto_register_template(&seqiv_tmpl);
 901         if (err)
 902                 goto out;
 903
 904         err = crypto_register_template(&seqniv_tmpl);
 905         if (err)
 906                 goto out_undo_niv;
 907
 908 out:
 909         return err;
 910
 911 out_undo_niv:
 912         crypto_unregister_template(&seqiv_tmpl);
 913         goto out;
 914 }
 915
 916 static void __exit seqiv_module_exit(void)
 917 {
 918         crypto_unregister_template(&seqiv_tmpl);
 919 }
 920
 921 module_init(seqiv_module_init);
 922 module_exit(seqiv_module_exit);
 923
 924 MODULE_LICENSE("GPL");
 925 MODULE_DESCRIPTION("Sequence Number IV Generator");
 926 MODULE_ALIAS_CRYPTO("seqiv");
 927 MODULE_ALIAS_CRYPTO("seqniv");