diff options
author | Rich Salz <rsalz@openssl.org> | 2017-06-13 16:33:33 -0400 |
---|---|---|
committer | Rich Salz <rsalz@openssl.org> | 2017-06-19 09:31:45 -0400 |
commit | f39a5501ce69cab0c7282f5dcbf2b80d8ee259f2 (patch) | |
tree | c5c9a3f4224fdf87b98813fb81f61c7b4ad72bc6 | |
parent | 3ac6d5ee5372b05aa90cc5c44efbde01bd669e9e (diff) |
Remove bsd_cryptodev engine
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3699)
-rw-r--r-- | CHANGES | 3 | ||||
-rw-r--r-- | README.ENGINE | 1 | ||||
-rw-r--r-- | crypto/engine/build.info | 2 | ||||
-rw-r--r-- | crypto/engine/eng_all.c | 8 | ||||
-rw-r--r-- | crypto/engine/eng_cryptodev.c | 2037 | ||||
-rw-r--r-- | crypto/include/internal/engine.h | 1 | ||||
-rw-r--r-- | crypto/init.c | 19 | ||||
-rw-r--r-- | include/openssl/engine.h | 2 |
8 files changed, 6 insertions, 2067 deletions
@@ -9,6 +9,9 @@ Changes between 1.1.0f and 1.1.1 [xx XXX xxxx] + *) Removed BSD cryptodev engine. + [Rich Salz] + *) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything diff --git a/README.ENGINE b/README.ENGINE index 530a4eddb9..230dc82a87 100644 --- a/README.ENGINE +++ b/README.ENGINE @@ -13,7 +13,6 @@ There are currently built-in ENGINE implementations for the following crypto devices: - o Cryptodev o Microsoft CryptoAPI o VIA Padlock o nCipher CHIL diff --git a/crypto/engine/build.info b/crypto/engine/build.info index 161dad4d02..47fe948966 100644 --- a/crypto/engine/build.info +++ b/crypto/engine/build.info @@ -4,5 +4,5 @@ SOURCE[../../libcrypto]=\ eng_table.c eng_pkey.c eng_fat.c eng_all.c \ tb_rsa.c tb_dsa.c tb_dh.c tb_rand.c \ tb_cipher.c tb_digest.c tb_pkmeth.c tb_asnmth.c tb_eckey.c \ - eng_openssl.c eng_cnf.c eng_dyn.c eng_cryptodev.c \ + eng_openssl.c eng_cnf.c eng_dyn.c \ eng_rdrand.c diff --git a/crypto/engine/eng_all.c b/crypto/engine/eng_all.c index 50fe4cba9e..c0d0b1cb07 100644 --- a/crypto/engine/eng_all.c +++ b/crypto/engine/eng_all.c @@ -18,14 +18,8 @@ void ENGINE_load_builtin_engines(void) OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL); } -#if (defined(__OpenBSD__) || defined(__FreeBSD__) || defined(__DragonFly__) || defined(HAVE_CRYPTODEV)) && !defined(OPENSSL_NO_DEPRECATED) +#if (defined(__OpenBSD__) || defined(__FreeBSD__) || defined(__DragonFly__)) && !defined(OPENSSL_NO_DEPRECATED) void ENGINE_setup_bsd_cryptodev(void) { - static int bsd_cryptodev_default_loaded = 0; - if (!bsd_cryptodev_default_loaded) { - OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_CRYPTODEV, NULL); - ENGINE_register_all_complete(); - } - bsd_cryptodev_default_loaded = 1; } #endif diff --git a/crypto/engine/eng_cryptodev.c b/crypto/engine/eng_cryptodev.c deleted file mode 100644 index 94480e9bd1..0000000000 --- a/crypto/engine/eng_cryptodev.c +++ /dev/null @@ -1,2037 +0,0 @@ -/* - * Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the OpenSSL license (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -/* - * Copyright (c) 2002 Bob Beck <beck@openbsd.org> - * Copyright (c) 2002 Theo de Raadt - * Copyright (c) 2002 Markus Friedl - * Copyright (c) 2012 Nikos Mavrogiannopoulos - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY - * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED - * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE - * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY - * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND - * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - * - */ - -#include <openssl/objects.h> -#include <internal/engine.h> -#include <openssl/evp.h> -#include <openssl/bn.h> -#include <openssl/crypto.h> - -#if (defined(__unix__) || defined(unix)) && !defined(USG) && \ - (defined(OpenBSD) || defined(__FreeBSD__) || defined(__DragonFly__)) -# include <sys/param.h> -# if (OpenBSD >= 200112) || ((__FreeBSD_version >= 470101 && __FreeBSD_version < 500000) || __FreeBSD_version >= 500041) || defined(__DragonFly__) -# define HAVE_CRYPTODEV -# endif -# if (OpenBSD >= 200110) -# define HAVE_SYSLOG_R -# endif -#endif - -#include <sys/types.h> -#ifdef HAVE_CRYPTODEV -# include <crypto/cryptodev.h> -# include <sys/ioctl.h> -# include <errno.h> -# include <stdio.h> -# include <unistd.h> -# include <fcntl.h> -# include <stdarg.h> -# include <syslog.h> -# include <errno.h> -# include <string.h> -#endif -#include <openssl/dh.h> -#include <openssl/dsa.h> -#include <openssl/err.h> -#include <openssl/rsa.h> - -#ifndef HAVE_CRYPTODEV - -void engine_load_cryptodev_int(void) -{ - /* This is a NOP on platforms without /dev/crypto */ - return; -} - -#else - -/* Available on cryptodev-linux but not on FreeBSD 8.4 */ -# ifndef CRYPTO_HMAC_MAX_KEY_LEN -# define CRYPTO_HMAC_MAX_KEY_LEN 512 -# endif -# ifndef CRYPTO_CIPHER_MAX_KEY_LEN -# define CRYPTO_CIPHER_MAX_KEY_LEN 64 -# endif - -struct dev_crypto_state { - struct session_op d_sess; - int d_fd; -# ifdef USE_CRYPTODEV_DIGESTS - unsigned char digest_res[HASH_MAX_LEN]; - char *mac_data; - int mac_len; -# endif -}; - -static u_int32_t cryptodev_asymfeat = 0; - -static RSA_METHOD *cryptodev_rsa; -# ifndef OPENSSL_NO_DSA -static DSA_METHOD *cryptodev_dsa = NULL; -# endif -# ifndef OPENSSL_NO_DH -static DH_METHOD *cryptodev_dh; -# endif - -static int get_asym_dev_crypto(void); -static int open_dev_crypto(void); -static int get_dev_crypto(void); -static int get_cryptodev_ciphers(const int **cnids); -# ifdef USE_CRYPTODEV_DIGESTS -static int get_cryptodev_digests(const int **cnids); -# endif -static int cryptodev_usable_ciphers(const int **nids); -static int cryptodev_usable_digests(const int **nids); -static int cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl); -static int cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc); -static int cryptodev_cleanup(EVP_CIPHER_CTX *ctx); -static int cryptodev_engine_ciphers(ENGINE *e, const EVP_CIPHER **cipher, - const int **nids, int nid); -static int cryptodev_engine_digests(ENGINE *e, const EVP_MD **digest, - const int **nids, int nid); -static int bn2crparam(const BIGNUM *a, struct crparam *crp); -static int crparam2bn(struct crparam *crp, BIGNUM *a); -static void zapparams(struct crypt_kop *kop); -static int cryptodev_asym(struct crypt_kop *kop, int rlen, BIGNUM *r, - int slen, BIGNUM *s); - -static int cryptodev_bn_mod_exp(BIGNUM *r, const BIGNUM *a, - const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, - BN_MONT_CTX *m_ctx); -static int cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, - BN_CTX *ctx); -static int cryptodev_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, - BN_CTX *ctx); -# ifndef OPENSSL_NO_DSA -static int cryptodev_dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, const BIGNUM *a, - const BIGNUM *p, const BIGNUM *m, - BN_CTX *ctx, BN_MONT_CTX *m_ctx); -static int cryptodev_dsa_dsa_mod_exp(DSA *dsa, BIGNUM *t1, const BIGNUM *g, - const BIGNUM *u1, const BIGNUM *pub_key, - const BIGNUM *u2, const BIGNUM *p, - BN_CTX *ctx, BN_MONT_CTX *mont); -static DSA_SIG *cryptodev_dsa_do_sign(const unsigned char *dgst, int dlen, - DSA *dsa); -static int cryptodev_dsa_verify(const unsigned char *dgst, int dgst_len, - DSA_SIG *sig, DSA *dsa); -# endif -# ifndef OPENSSL_NO_DH -static int cryptodev_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a, - const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, - BN_MONT_CTX *m_ctx); -static int cryptodev_dh_compute_key(unsigned char *key, const BIGNUM *pub_key, - DH *dh); -# endif -static int cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, - void (*f) (void)); -void engine_load_cryptodev_int(void); - -static const ENGINE_CMD_DEFN cryptodev_defns[] = { - {0, NULL, NULL, 0} -}; - -static struct { - int id; - int nid; - int ivmax; - int keylen; -} ciphers[] = { - {CRYPTO_ARC4, NID_rc4, 0, 16}, - {CRYPTO_DES_CBC, NID_des_cbc, 8, 8}, -# if defined(CRYPTO_3DES_CBC) - {CRYPTO_3DES_CBC, NID_des_ede3_cbc, 8, 24}, -# endif - -/* - * The marvell-kirkwood armv5 platform doesn't seem to have CRYPTO_3DES_ECB. - * Unfortunately, there is no way to detect this, except on BSD, where the - * crypto identities are implemented as macros. All other cryptodev - * implementations will be without this one. - */ -# if defined(CRYPTO_3DES_ECB) - {CRYPTO_3DES_ECB, NID_des_ede3_ecb, 0, 24}, -# endif - - {CRYPTO_AES_CBC, NID_aes_128_cbc, 16, 16}, - {CRYPTO_AES_CBC, NID_aes_192_cbc, 16, 24}, - {CRYPTO_AES_CBC, NID_aes_256_cbc, 16, 32}, -# if !defined(CRYPTO_ALGORITHM_MIN) || defined(CRYPTO_AES_CTR) - {CRYPTO_AES_CTR, NID_aes_128_ctr, 14, 16}, - {CRYPTO_AES_CTR, NID_aes_192_ctr, 14, 24}, - {CRYPTO_AES_CTR, NID_aes_256_ctr, 14, 32}, -# endif -# if !defined(CRYPTO_ALGORITHM_MIN) || defined(CRYPTO_AES_ECB) - {CRYPTO_AES_ECB, NID_aes_128_ecb, 0, 16}, - {CRYPTO_AES_ECB, NID_aes_192_ecb, 0, 24}, - {CRYPTO_AES_ECB, NID_aes_256_ecb, 0, 32}, -# endif - {CRYPTO_BLF_CBC, NID_bf_cbc, 8, 16}, - {CRYPTO_CAST_CBC, NID_cast5_cbc, 8, 16}, - {CRYPTO_SKIPJACK_CBC, NID_undef, 0, 0}, - {0, NID_undef, 0, 0}, -}; - -# ifdef USE_CRYPTODEV_DIGESTS -static struct { - int id; - int nid; - int digestlen; -} digests[] = { - {CRYPTO_MD5, NID_md5, 16}, - {CRYPTO_SHA1, NID_sha1, 20}, - {CRYPTO_SHA2_256, NID_sha256, 32}, - {CRYPTO_SHA2_384, NID_sha384, 48}, - {CRYPTO_SHA2_512, NID_sha512, 64}, - {0, NID_undef, 0}, -}; -# endif - -/* - * Return a fd if /dev/crypto seems usable, 0 otherwise. - */ -static int open_dev_crypto(void) -{ - static int fd = -1; - - if (fd == -1) { - if ((fd = open("/dev/crypto", O_RDWR, 0)) == -1) - return (-1); - /* close on exec */ - if (fcntl(fd, F_SETFD, 1) == -1) { - close(fd); - fd = -1; - return (-1); - } - } - return (fd); -} - -static int get_dev_crypto(void) -{ - int fd, retfd; - - if ((fd = open_dev_crypto()) == -1) - return (-1); -# ifndef CRIOGET_NOT_NEEDED - if (ioctl(fd, CRIOGET, &retfd) == -1) - return (-1); - - /* close on exec */ - if (fcntl(retfd, F_SETFD, 1) == -1) { - close(retfd); - return (-1); - } -# else - retfd = fd; -# endif - return (retfd); -} - -static void put_dev_crypto(int fd) -{ -# ifndef CRIOGET_NOT_NEEDED - close(fd); -# endif -} - -/* Caching version for asym operations */ -static int get_asym_dev_crypto(void) -{ - static int fd = -1; - - if (fd == -1) - fd = get_dev_crypto(); - return fd; -} - -/* - * Find out what ciphers /dev/crypto will let us have a session for. - * XXX note, that some of these openssl doesn't deal with yet! - * returning them here is harmless, as long as we return NULL - * when asked for a handler in the cryptodev_engine_ciphers routine - */ -static int get_cryptodev_ciphers(const int **cnids) -{ - static int nids[CRYPTO_ALGORITHM_MAX]; - struct session_op sess; - int fd, i, count = 0; - unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN]; - - if ((fd = get_dev_crypto()) < 0) { - *cnids = NULL; - return (0); - } - memset(&sess, 0, sizeof(sess)); - sess.key = (void *)fake_key; - - for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) { - if (ciphers[i].nid == NID_undef) - continue; - sess.cipher = ciphers[i].id; - sess.keylen = ciphers[i].keylen; - sess.mac = 0; - if (ioctl(fd, CIOCGSESSION, &sess) != -1 && - ioctl(fd, CIOCFSESSION, &sess.ses) != -1) - nids[count++] = ciphers[i].nid; - } - put_dev_crypto(fd); - - if (count > 0) - *cnids = nids; - else - *cnids = NULL; - return (count); -} - -# ifdef USE_CRYPTODEV_DIGESTS -/* - * Find out what digests /dev/crypto will let us have a session for. - * XXX note, that some of these openssl doesn't deal with yet! - * returning them here is harmless, as long as we return NULL - * when asked for a handler in the cryptodev_engine_digests routine - */ -static int get_cryptodev_digests(const int **cnids) -{ - static int nids[CRYPTO_ALGORITHM_MAX]; - unsigned char fake_key[CRYPTO_CIPHER_MAX_KEY_LEN]; - struct session_op sess; - int fd, i, count = 0; - - if ((fd = get_dev_crypto()) < 0) { - *cnids = NULL; - return (0); - } - memset(&sess, 0, sizeof(sess)); - sess.mackey = fake_key; - for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) { - if (digests[i].nid == NID_undef) - continue; - sess.mac = digests[i].id; - sess.mackeylen = 8; - sess.cipher = 0; - if (ioctl(fd, CIOCGSESSION, &sess) != -1 && - ioctl(fd, CIOCFSESSION, &sess.ses) != -1) - nids[count++] = digests[i].nid; - } - put_dev_crypto(fd); - - if (count > 0) - *cnids = nids; - else - *cnids = NULL; - return (count); -} -# endif /* 0 */ - -/* - * Find the useable ciphers|digests from dev/crypto - this is the first - * thing called by the engine init crud which determines what it - * can use for ciphers from this engine. We want to return - * only what we can do, anything else is handled by software. - * - * If we can't initialize the device to do anything useful for - * any reason, we want to return a NULL array, and 0 length, - * which forces everything to be done is software. By putting - * the initialization of the device in here, we ensure we can - * use this engine as the default, and if for whatever reason - * /dev/crypto won't do what we want it will just be done in - * software - * - * This can (should) be greatly expanded to perhaps take into - * account speed of the device, and what we want to do. - * (although the disabling of particular alg's could be controlled - * by the device driver with sysctl's.) - this is where we - * want most of the decisions made about what we actually want - * to use from /dev/crypto. - */ -static int cryptodev_usable_ciphers(const int **nids) -{ - return (get_cryptodev_ciphers(nids)); -} - -static int cryptodev_usable_digests(const int **nids) -{ -# ifdef USE_CRYPTODEV_DIGESTS - return (get_cryptodev_digests(nids)); -# else - /* - * XXXX just disable all digests for now, because it sucks. - * we need a better way to decide this - i.e. I may not - * want digests on slow cards like hifn on fast machines, - * but might want them on slow or loaded machines, etc. - * will also want them when using crypto cards that don't - * suck moose gonads - would be nice to be able to decide something - * as reasonable default without having hackery that's card dependent. - * of course, the default should probably be just do everything, - * with perhaps a sysctl to turn algorithms off (or have them off - * by default) on cards that generally suck like the hifn. - */ - *nids = NULL; - return (0); -# endif -} - -static int -cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, - const unsigned char *in, size_t inl) -{ - struct crypt_op cryp; - struct dev_crypto_state *state = EVP_CIPHER_CTX_get_cipher_data(ctx); - struct session_op *sess = &state->d_sess; - const void *iiv; - unsigned char save_iv[EVP_MAX_IV_LENGTH]; - - if (state->d_fd < 0) - return (0); - if (!inl) - return (1); - if ((inl % EVP_CIPHER_CTX_block_size(ctx)) != 0) - return (0); - - memset(&cryp, 0, sizeof(cryp)); - - cryp.ses = sess->ses; - cryp.flags = 0; - cryp.len = inl; - cryp.src = (void *)in; - cryp.dst = (void *)out; - cryp.mac = 0; - - cryp.op = EVP_CIPHER_CTX_encrypting(ctx) ? COP_ENCRYPT : COP_DECRYPT; - - if (EVP_CIPHER_CTX_iv_length(ctx) > 0) { - cryp.iv = (void *)EVP_CIPHER_CTX_iv(ctx); - if (!EVP_CIPHER_CTX_encrypting(ctx)) { - iiv = in + inl - EVP_CIPHER_CTX_iv_length(ctx); - memcpy(save_iv, iiv, EVP_CIPHER_CTX_iv_length(ctx)); - } - } else - cryp.iv = NULL; - - if (ioctl(state->d_fd, CIOCCRYPT, &cryp) == -1) { - /* - * XXX need better error handling this can fail for a number of - * different reasons. - */ - return (0); - } - - if (EVP_CIPHER_CTX_iv_length(ctx) > 0) { - if (EVP_CIPHER_CTX_encrypting(ctx)) - iiv = out + inl - EVP_CIPHER_CTX_iv_length(ctx); - else - iiv = save_iv; - memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iiv, - EVP_CIPHER_CTX_iv_length(ctx)); - } - return (1); -} - -static int -cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, - const unsigned char *iv, int enc) -{ - struct dev_crypto_state *state = EVP_CIPHER_CTX_get_cipher_data(ctx); - struct session_op *sess = &state->d_sess; - int cipher = -1, i; - - for (i = 0; ciphers[i].id; i++) - if (EVP_CIPHER_CTX_nid(ctx) == ciphers[i].nid && - EVP_CIPHER_CTX_iv_length(ctx) <= ciphers[i].ivmax && - EVP_CIPHER_CTX_key_length(ctx) == ciphers[i].keylen) { - cipher = ciphers[i].id; - break; - } - - if (!ciphers[i].id) { - state->d_fd = -1; - return (0); - } - - memset(sess, 0, sizeof(*sess)); - - if ((state->d_fd = get_dev_crypto()) < 0) - return (0); - - sess->key = (void *)key; - sess->keylen = EVP_CIPHER_CTX_key_length(ctx); - sess->cipher = cipher; - - if (ioctl(state->d_fd, CIOCGSESSION, sess) == -1) { - put_dev_crypto(state->d_fd); - state->d_fd = -1; - return (0); - } - return (1); -} - -/* - * free anything we allocated earlier when initing a - * session, and close the session. - */ -static int cryptodev_cleanup(EVP_CIPHER_CTX *ctx) -{ - int ret = 0; - struct dev_crypto_state *state = EVP_CIPHER_CTX_get_cipher_data(ctx); - struct session_op *sess = &state->d_sess; - - if (state->d_fd < 0) - return (0); - - /* - * XXX if this ioctl fails, something's wrong. the invoker may have called - * us with a bogus ctx, or we could have a device that for whatever - * reason just doesn't want to play ball - it's not clear what's right - * here - should this be an error? should it just increase a counter, - * hmm. For right now, we return 0 - I don't believe that to be "right". - * we could call the gorpy openssl lib error handlers that print messages - * to users of the library. hmm.. - */ - - if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) == -1) { - ret = 0; - } else { - ret = 1; - } - put_dev_crypto(state->d_fd); - state->d_fd = -1; - - return (ret); -} - -/* - * libcrypto EVP stuff - this is how we get wired to EVP so the engine - * gets called when libcrypto requests a cipher NID. - */ - -static int cryptodev_cipher_ctrl(EVP_CIPHER_CTX *ctx, int type, int p1, void *p2) -{ - struct dev_crypto_state *state = EVP_CIPHER_CTX_get_cipher_data(ctx); - struct session_op *sess = &state->d_sess; - - if (type == EVP_CTRL_COPY) { - EVP_CIPHER_CTX *out = p2; - return cryptodev_init_key(out, (unsigned char *)sess->key, - EVP_CIPHER_CTX_iv(ctx), 0); - } - - return 0; -} - -/* RC4 */ -static EVP_CIPHER *rc4_cipher = NULL; -static const EVP_CIPHER *cryptodev_rc4(void) -{ - if (rc4_cipher == NULL) { - EVP_CIPHER *cipher = EVP_CIPHER_meth_new(NID_rc4, 1, 16); - - if (cipher == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 0) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_VARIABLE_LENGTH - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(cipher, cryptodev_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, cryptodev_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher, cryptodev_cleanup) - || !EVP_CIPHER_meth_set_ctrl(cipher, cryptodev_cipher_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, - sizeof(struct - dev_crypto_state))) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - rc4_cipher = cipher; - } - return rc4_cipher; -} - -/* DES CBC EVP */ -static EVP_CIPHER *des_cbc_cipher = NULL; -static const EVP_CIPHER *cryptodev_des_cbc(void) -{ - if (des_cbc_cipher == NULL) { - EVP_CIPHER *cipher = EVP_CIPHER_meth_new(NID_des_cbc, 8, 8); - - if (cipher == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 8) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_CBC_MODE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(cipher, cryptodev_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, cryptodev_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher, cryptodev_cleanup) - || !EVP_CIPHER_meth_set_ctrl(cipher, cryptodev_cipher_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, - sizeof(struct - dev_crypto_state)) - || !EVP_CIPHER_meth_set_set_asn1_params(cipher, - EVP_CIPHER_set_asn1_iv) - || !EVP_CIPHER_meth_set_get_asn1_params(cipher, - EVP_CIPHER_get_asn1_iv)) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - des_cbc_cipher = cipher; - } - return des_cbc_cipher; -} - -/* 3DES CBC EVP */ -static EVP_CIPHER *des3_cbc_cipher = NULL; -static const EVP_CIPHER *cryptodev_3des_cbc(void) -{ - if (des3_cbc_cipher == NULL) { - EVP_CIPHER *cipher = EVP_CIPHER_meth_new(NID_des_ede3_cbc, 8, 24); - - if (cipher == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 8) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_CBC_MODE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(cipher, cryptodev_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, cryptodev_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher, cryptodev_cleanup) - || !EVP_CIPHER_meth_set_ctrl(cipher, cryptodev_cipher_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, - sizeof(struct - dev_crypto_state)) - || !EVP_CIPHER_meth_set_set_asn1_params(cipher, - EVP_CIPHER_set_asn1_iv) - || !EVP_CIPHER_meth_set_get_asn1_params(cipher, - EVP_CIPHER_get_asn1_iv)) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - des3_cbc_cipher = cipher; - } - return des3_cbc_cipher; -} - -/* 3DES ECB EVP */ -static EVP_CIPHER *des3_ecb_cipher = NULL; -static const EVP_CIPHER *cryptodev_3des_ecb(void) -{ - if (des3_ecb_cipher == NULL) { - EVP_CIPHER *cipher = EVP_CIPHER_meth_new(NID_des_ede3_ecb, 8, 24); - - if (cipher == NULL - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_ECB_MODE) - || !EVP_CIPHER_meth_set_init(cipher, cryptodev_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, cryptodev_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher, cryptodev_cleanup) - || !EVP_CIPHER_meth_set_ctrl(cipher, cryptodev_cipher_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, - sizeof(struct - dev_crypto_state))) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - des3_ecb_cipher = cipher; - } - return des3_ecb_cipher; -} - -static EVP_CIPHER *bf_cbc_cipher = NULL; -static const EVP_CIPHER *cryptodev_bf_cbc(void) -{ - if (bf_cbc_cipher == NULL) { - EVP_CIPHER *cipher = EVP_CIPHER_meth_new(NID_bf_cbc, 8, 16); - - if (cipher == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 8) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_CBC_MODE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(cipher, cryptodev_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, cryptodev_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher, cryptodev_cleanup) - || !EVP_CIPHER_meth_set_ctrl(cipher, cryptodev_cipher_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, - sizeof(struct - dev_crypto_state)) - || !EVP_CIPHER_meth_set_set_asn1_params(cipher, - EVP_CIPHER_set_asn1_iv) - || !EVP_CIPHER_meth_set_get_asn1_params(cipher, - EVP_CIPHER_get_asn1_iv)) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - bf_cbc_cipher = cipher; - } - return bf_cbc_cipher; -} - -static EVP_CIPHER *cast_cbc_cipher = NULL; -static const EVP_CIPHER *cryptodev_cast_cbc(void) -{ - if (cast_cbc_cipher == NULL) { - EVP_CIPHER *cipher = EVP_CIPHER_meth_new(NID_cast5_cbc, 8, 16); - - if (cipher == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 8) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_CBC_MODE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(cipher, cryptodev_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, cryptodev_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher, cryptodev_cleanup) - || !EVP_CIPHER_meth_set_ctrl(cipher, cryptodev_cipher_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, - sizeof(struct - dev_crypto_state)) - || !EVP_CIPHER_meth_set_set_asn1_params(cipher, - EVP_CIPHER_set_asn1_iv) - || !EVP_CIPHER_meth_set_get_asn1_params(cipher, - EVP_CIPHER_get_asn1_iv)) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - cast_cbc_cipher = cipher; - } - return cast_cbc_cipher; -} - -static EVP_CIPHER *aes_cbc_cipher = NULL; -static const EVP_CIPHER *cryptodev_aes_cbc(void) -{ - if (aes_cbc_cipher == NULL) { - EVP_CIPHER *cipher = EVP_CIPHER_meth_new(NID_aes_128_cbc, 16, 16); - - if (cipher == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 16) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_CBC_MODE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(cipher, cryptodev_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, cryptodev_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher, cryptodev_cleanup) - || !EVP_CIPHER_meth_set_ctrl(cipher, cryptodev_cipher_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, - sizeof(struct - dev_crypto_state)) - || !EVP_CIPHER_meth_set_set_asn1_params(cipher, - EVP_CIPHER_set_asn1_iv) - || !EVP_CIPHER_meth_set_get_asn1_params(cipher, - EVP_CIPHER_get_asn1_iv)) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - aes_cbc_cipher = cipher; - } - return aes_cbc_cipher; -} - -static EVP_CIPHER *aes_192_cbc_cipher = NULL; -static const EVP_CIPHER *cryptodev_aes_192_cbc(void) -{ - if (aes_192_cbc_cipher == NULL) { - EVP_CIPHER *cipher = EVP_CIPHER_meth_new(NID_aes_192_cbc, 16, 24); - - if (cipher == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 16) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_CBC_MODE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(cipher, cryptodev_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, cryptodev_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher, cryptodev_cleanup) - || !EVP_CIPHER_meth_set_ctrl(cipher, cryptodev_cipher_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, - sizeof(struct - dev_crypto_state)) - || !EVP_CIPHER_meth_set_set_asn1_params(cipher, - EVP_CIPHER_set_asn1_iv) - || !EVP_CIPHER_meth_set_get_asn1_params(cipher, - EVP_CIPHER_get_asn1_iv)) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - aes_192_cbc_cipher = cipher; - } - return aes_192_cbc_cipher; -} - -static EVP_CIPHER *aes_256_cbc_cipher = NULL; -static const EVP_CIPHER *cryptodev_aes_256_cbc(void) -{ - if (aes_256_cbc_cipher == NULL) { - EVP_CIPHER *cipher = EVP_CIPHER_meth_new(NID_aes_256_cbc, 16, 32); - - if (cipher == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 16) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_CBC_MODE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(cipher, cryptodev_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, cryptodev_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher, cryptodev_cleanup) - || !EVP_CIPHER_meth_set_ctrl(cipher, cryptodev_cipher_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, - sizeof(struct - dev_crypto_state)) - || !EVP_CIPHER_meth_set_set_asn1_params(cipher, - EVP_CIPHER_set_asn1_iv) - || !EVP_CIPHER_meth_set_get_asn1_params(cipher, - EVP_CIPHER_get_asn1_iv)) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - aes_256_cbc_cipher = cipher; - } - return aes_256_cbc_cipher; -} - -static EVP_CIPHER *aes_ctr_cipher = NULL; -static const EVP_CIPHER *cryptodev_aes_ctr(void) -{ - if (aes_ctr_cipher == NULL) { - EVP_CIPHER *cipher = EVP_CIPHER_meth_new(NID_aes_128_ctr, 16, 16); - - if (cipher == NULL - || !EVP_CIPHER_meth_set_iv_length(cipher, 14) - || !EVP_CIPHER_meth_set_flags(cipher, EVP_CIPH_CTR_MODE - | EVP_CIPH_CUSTOM_COPY) - || !EVP_CIPHER_meth_set_init(cipher, cryptodev_init_key) - || !EVP_CIPHER_meth_set_do_cipher(cipher, cryptodev_cipher) - || !EVP_CIPHER_meth_set_cleanup(cipher, cryptodev_cleanup) - || !EVP_CIPHER_meth_set_ctrl(cipher, cryptodev_cipher_ctrl) - || !EVP_CIPHER_meth_set_impl_ctx_size(cipher, - sizeof(struct - dev_crypto_state)) - || !EVP_CIPHER_meth_set_set_asn1_params(cipher, - EVP_CIPHER_set_asn1_iv) - || !EVP_CIPHER_meth_set_get_asn1_params(cipher, - EVP_CIPHER_get_asn1_iv)) { - EVP_CIPHER_meth_free(cipher); - cipher = NULL; - } - aes_ctr_cipher = cipher; - } - return aes_ctr_cipher; -} - -static EVP_CIPHER *aes_192_ctr_cipher = NULL; -static const EVP_CIPHER *cryptodev_aes_192_ctr(void) |