aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohn Baldwin <jhb@FreeBSD.org>2021-11-30 08:19:47 -0800
committerJohn Baldwin <jhb@FreeBSD.org>2021-11-30 08:24:21 -0800
commit448ee40b27a45aa8dcec6d6bf790d8ffd7b54290 (patch)
treea13223b8d4d9c224bc26eecfabd5bf9eb5eac9f2
parentUse the global chacha20_poly1305 session for the data path. (diff)
downloadwireguard-freebsd-jb-wip.tar.xz
wireguard-freebsd-jb-wip.zip
Use OCF for XChacha20-Poly1305 when present.jb-wip
Signed-off-by: John Baldwin <jhb@FreeBSD.org>
-rw-r--r--src/crypto.c98
-rw-r--r--src/crypto.h33
2 files changed, 91 insertions, 40 deletions
diff --git a/src/crypto.c b/src/crypto.c
index 87f2aca..0abf718 100644
--- a/src/crypto.c
+++ b/src/crypto.c
@@ -5,15 +5,18 @@
#include <sys/types.h>
#include <sys/endian.h>
+#include <sys/malloc.h>
#include <sys/systm.h>
+#include <opencrypto/cryptodev.h>
#include "crypto.h"
#ifdef OCF_CHACHA20_POLY1305
-#include <opencrypto/cryptodev.h>
-
static crypto_session_t chacha20_poly1305_sid;
#endif
+#ifdef CRYPTO_XCHACHA20_POLY1305
+static crypto_session_t xchacha20_poly1305_sid;
+#endif
#ifndef ARRAY_SIZE
#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
@@ -39,7 +42,7 @@ static inline uint32_t get_unaligned_le32(const uint8_t *a)
__builtin_memcpy(&l, a, sizeof(l));
return le32_to_cpup(&l);
}
-#if !defined(OCF_CHACHA20_POLY1305) || !defined(LIBSODIUM_CHACHA20)
+#if !defined(OCF_CHACHA20_POLY1305) || !defined(CRYPTO_XCHACHA20_POLY1305)
static inline uint64_t get_unaligned_le64(const uint8_t *a)
{
uint64_t l;
@@ -67,7 +70,7 @@ static inline void le32_to_cpu_array(uint32_t *buf, unsigned int words)
}
}
-#if !defined(OCF_CHACHA20_POLY1305) || !defined(LIBSODIUM_CHACHA20)
+#if !defined(OCF_CHACHA20_POLY1305) || !defined(CRYPTO_XCHACHA20_POLY1305)
static inline uint32_t rol32(uint32_t word, unsigned int shift)
{
return (word << (shift & 31)) | (word >> ((-shift) & 31));
@@ -78,7 +81,7 @@ static inline uint32_t ror32(uint32_t word, unsigned int shift)
return (word >> (shift & 31)) | (word << ((-shift) & 31));
}
-#if !defined(OCF_CHACHA20_POLY1305) || !defined(LIBSODIUM_CHACHA20)
+#if !defined(OCF_CHACHA20_POLY1305) || !defined(CRYPTO_XCHACHA20_POLY1305)
static void xor_cpy(uint8_t *dst, const uint8_t *src1, const uint8_t *src2,
size_t len)
{
@@ -811,7 +814,64 @@ chacha20poly1305_decrypt_mbuf(struct mbuf *m, const uint64_t nonce,
}
#endif
-#ifndef LIBSODIUM_CHACHA20
+#ifdef CRYPTO_XCHACHA20_POLY1305
+void
+xchacha20poly1305_encrypt(uint8_t *dst, const uint8_t *src,
+ const size_t src_len, const uint8_t *ad,
+ const size_t ad_len,
+ const uint8_t nonce[XCHACHA20POLY1305_NONCE_SIZE],
+ const uint8_t key[CHACHA20POLY1305_KEY_SIZE])
+{
+ struct cryptop crp;
+ int error;
+
+ crypto_initreq(&crp, xchacha20_poly1305_sid);
+ crp.crp_op = CRYPTO_OP_ENCRYPT | CRYPTO_OP_COMPUTE_DIGEST;
+ crp.crp_flags = CRYPTO_F_IV_SEPARATE | CRYPTO_F_CBIMM;
+ crp.crp_aad = __DECONST(uint8_t *, ad);
+ crp.crp_aad_length = ad_len;
+ crypto_use_buf(&crp, __DECONST(uint8_t *, src), src_len);
+ crypto_use_output_buf(&crp, dst, src_len + POLY1305_HASH_LEN);
+ crp.crp_payload_length = src_len;
+ crp.crp_digest_start = crp.crp_payload_length;
+ memcpy(crp.crp_iv, nonce, XCHACHA20POLY1305_NONCE_SIZE);
+ crp.crp_cipher_key = key;
+ crp.crp_callback = crypto_callback;
+ error = crypto_dispatch(&crp);
+ KASSERT(error == 0, ("%s: crypto_dispatch failed with %d",
+ __func__, error));
+ crypto_destroyreq(&crp);
+}
+
+bool
+xchacha20poly1305_decrypt(uint8_t *dst, const uint8_t *src,
+ const size_t src_len, const uint8_t *ad,
+ const size_t ad_len,
+ const uint8_t nonce[XCHACHA20POLY1305_NONCE_SIZE],
+ const uint8_t key[CHACHA20POLY1305_KEY_SIZE])
+{
+ struct cryptop crp;
+ int error;
+
+ crypto_initreq(&crp, xchacha20_poly1305_sid);
+ crp.crp_op = CRYPTO_OP_DECRYPT | CRYPTO_OP_VERIFY_DIGEST;
+ crp.crp_flags = CRYPTO_F_IV_SEPARATE | CRYPTO_F_CBIMM;
+ crp.crp_aad = __DECONST(uint8_t *, ad);
+ crp.crp_aad_length = ad_len;
+ crypto_use_buf(&crp, __DECONST(uint8_t *, src), src_len);
+ crypto_use_output_buf(&crp, dst, src_len - POLY1305_HASH_LEN);
+ crp.crp_payload_length = src_len - POLY1305_HASH_LEN;
+ crp.crp_digest_start = crp.crp_payload_length;
+ memcpy(crp.crp_iv, nonce, XCHACHA20POLY1305_NONCE_SIZE);
+ crp.crp_cipher_key = key;
+ crp.crp_callback = crypto_callback;
+ error = crypto_dispatch(&crp);
+ KASSERT(error == 0 || error == EBADMSG,
+ ("%s: crypto_dispatch failed with %d", __func__, error));
+ crypto_destroyreq(&crp);
+ return (error == 0);
+}
+#else
void
xchacha20poly1305_encrypt(uint8_t *dst, const uint8_t *src,
const size_t src_len, const uint8_t *ad,
@@ -1924,10 +1984,12 @@ bool curve25519(uint8_t out[CURVE25519_KEY_SIZE],
int
crypto_init(void)
{
-#ifdef OCF_CHACHA20_POLY1305
+#if defined(OCF_CHACHA20_POLY1305) || defined(CRYPTO_XCHACHA20_POLY1305)
struct crypto_session_params csp;
int error;
+#endif
+#ifdef OCF_CHACHA20_POLY1305
memset(&csp, 0, sizeof(csp));
csp.csp_mode = CSP_MODE_AEAD;
csp.csp_ivlen = sizeof(uint64_t);
@@ -1939,12 +2001,34 @@ crypto_init(void)
if (error != 0)
return (error);
#endif
+
+#ifdef CRYPTO_XCHACHA20_POLY1305
+ memset(&csp, 0, sizeof(csp));
+ csp.csp_mode = CSP_MODE_AEAD;
+ csp.csp_ivlen = XCHACHA20POLY1305_NONCE_SIZE;
+ csp.csp_cipher_alg = CRYPTO_XCHACHA20_POLY1305;
+ csp.csp_cipher_klen = CHACHA20POLY1305_KEY_SIZE;
+ csp.csp_flags = CSP_F_SEPARATE_AAD | CSP_F_SEPARATE_OUTPUT;
+ error = crypto_newsession(&xchacha20_poly1305_sid, &csp,
+ CRYPTOCAP_F_SOFTWARE);
+ if (error != 0)
+ goto free_chacha20_poly1305;
+#endif
return (0);
+
+free_chacha20_poly1305:
+#ifdef OCF_CHACHA20_POLY1305
+ crypto_freesession(chacha20_poly1305_sid);
+#endif
+ return (error);
}
void
crypto_deinit(void)
{
+#ifdef CRYPTO_XCHACHA20_POLY1305
+ crypto_freesession(xchacha20_poly1305_sid);
+#endif
#ifdef OCF_CHACHA20_POLY1305
crypto_freesession(chacha20_poly1305_sid);
#endif
diff --git a/src/crypto.h b/src/crypto.h
index 91440c0..f827f6a 100644
--- a/src/crypto.h
+++ b/src/crypto.h
@@ -14,10 +14,6 @@
#define OCF_CHACHA20_POLY1305
#endif
-#if __FreeBSD_version >= 1300078
-#define LIBSODIUM_CHACHA20
-#endif
-
/* XXX: Update version for real */
#if __FreeBSD_version >= 1400042
#define KERNEL_CURVE25519
@@ -49,34 +45,6 @@ int
chacha20poly1305_decrypt_mbuf(struct mbuf *, const uint64_t nonce,
const uint8_t key[CHACHA20POLY1305_KEY_SIZE]);
-#ifdef LIBSODIUM_CHACHA20
-#include <sodium/crypto_aead_xchacha20poly1305.h>
-
-static __inline void
-xchacha20poly1305_encrypt(uint8_t *dst, const uint8_t *src,
- const size_t src_len, const uint8_t *ad,
- const size_t ad_len,
- const uint8_t nonce[XCHACHA20POLY1305_NONCE_SIZE],
- const uint8_t key[CHACHA20POLY1305_KEY_SIZE])
-{
- (void)crypto_aead_xchacha20poly1305_ietf_encrypt(dst, NULL, src,
- src_len, ad, ad_len, NULL, nonce, key);
-}
-
-static __inline bool
-xchacha20poly1305_decrypt(uint8_t *dst, const uint8_t *src,
- const size_t src_len, const uint8_t *ad,
- const size_t ad_len,
- const uint8_t nonce[XCHACHA20POLY1305_NONCE_SIZE],
- const uint8_t key[CHACHA20POLY1305_KEY_SIZE])
-{
- int rv;
-
- rv = crypto_aead_xchacha20poly1305_ietf_decrypt(dst, NULL, NULL,
- src, src_len, ad, ad_len, nonce, key);
- return (rv == 0);
-}
-#else
void
xchacha20poly1305_encrypt(uint8_t *dst, const uint8_t *src,
const size_t src_len, const uint8_t *ad,
@@ -90,7 +58,6 @@ xchacha20poly1305_decrypt(uint8_t *dst, const uint8_t *src,
const size_t ad_len,
const uint8_t nonce[XCHACHA20POLY1305_NONCE_SIZE],
const uint8_t key[CHACHA20POLY1305_KEY_SIZE]);
-#endif
enum blake2s_lengths {