diff options
| -rw-r--r-- | arch/arm/configs/cyanogenmod_i9300_defconfig | 4 | ||||
| -rw-r--r-- | crypto/Kconfig | 23 | ||||
| -rw-r--r-- | crypto/Makefile | 5 | ||||
| -rw-r--r-- | crypto/ablkcipher.c | 15 | ||||
| -rw-r--r-- | crypto/ahash.c | 30 | ||||
| -rw-r--r-- | crypto/algapi.c | 52 | ||||
| -rw-r--r-- | crypto/ansi_cprng.c | 19 | ||||
| -rw-r--r-- | crypto/api.c | 22 | ||||
| -rw-r--r-- | crypto/fips_integrity.c | 76 | ||||
| -rw-r--r-- | crypto/internal.h | 8 | ||||
| -rw-r--r-- | crypto/proc.c | 12 | ||||
| -rw-r--r-- | crypto/shash.c | 65 | ||||
| -rw-r--r-- | crypto/tcrypt.c | 160 | ||||
| -rw-r--r-- | crypto/testmgr.c | 92 | ||||
| -rw-r--r-- | include/crypto/aead.h | 21 | ||||
| -rw-r--r-- | include/crypto/algapi.h | 1 | ||||
| -rw-r--r-- | include/crypto/compress.h | 40 | ||||
| -rw-r--r-- | include/crypto/hash.h | 34 | ||||
| -rw-r--r-- | include/crypto/rng.h | 5 | ||||
| -rw-r--r-- | include/crypto/skcipher.h | 18 | ||||
| -rw-r--r-- | include/linux/crypto.h | 121 | ||||
| l--------- | include/net/bluetooth/hci_mon.h | 1 |
22 files changed, 101 insertions, 723 deletions
diff --git a/arch/arm/configs/cyanogenmod_i9300_defconfig b/arch/arm/configs/cyanogenmod_i9300_defconfig index 70846a5..98a5a06 100644 --- a/arch/arm/configs/cyanogenmod_i9300_defconfig +++ b/arch/arm/configs/cyanogenmod_i9300_defconfig @@ -3228,7 +3228,7 @@ CONFIG_CRYPTO=y # # Crypto core or helper # -CONFIG_CRYPTO_FIPS_INTEG_OFFSET=0x20000000 +#CONFIG_CRYPTO_FIPS_INTEG_OFFSET=0x20000000 CONFIG_CRYPTO_ALGAPI=y CONFIG_CRYPTO_ALGAPI2=y CONFIG_CRYPTO_AEAD=y @@ -3241,7 +3241,7 @@ CONFIG_CRYPTO_RNG2=y CONFIG_CRYPTO_PCOMP2=y CONFIG_CRYPTO_MANAGER=y CONFIG_CRYPTO_MANAGER2=y -CONFIG_CRYPTO_MANAGER_TESTS=y +#CONFIG_CRYPTO_MANAGER_TESTS=y # CONFIG_CRYPTO_GF128MUL is not set # CONFIG_CRYPTO_NULL is not set # CONFIG_CRYPTO_PCRYPT is not set diff --git a/crypto/Kconfig b/crypto/Kconfig index 3a6933c..87b22ca 100644 --- a/crypto/Kconfig +++ b/crypto/Kconfig @@ -23,22 +23,12 @@ comment "Crypto core or helper" config CRYPTO_FIPS bool "FIPS 200 compliance" - depends on CRYPTO_ANSI_CPRNG + depends on CRYPTO_ANSI_CPRNG && !CRYPTO_MANAGER_DISABLE_TESTS help This options enables the fips boot option which is required if you want to system to operate in a FIPS 200 certification. You should say no unless you know what - this is. Note that CRYPTO_ANSI_CPRNG is required if this - option is selected - -config CRYPTO_FIPS_INTEG_OFFSET - hex "FIPS integrity check zImage offset" - default 0x20000000 - help - This options sets the offset from stext address where - zImage will be copied for integrity check if you want - to system to operate in FIPS mode, which enables - kernel crypto module. + this is. config CRYPTO_ALGAPI tristate @@ -110,13 +100,13 @@ config CRYPTO_MANAGER2 select CRYPTO_BLKCIPHER2 select CRYPTO_PCOMP2 -config CRYPTO_MANAGER_TESTS - bool "Run algolithms' self-tests" +config CRYPTO_MANAGER_DISABLE_TESTS + bool "Disable run-time self tests" default y depends on CRYPTO_MANAGER2 help - Run cryptomanager's tests for the new crypto algorithms being - registered. + Disable run-time self tests that normally take place at + algorithm registration. config CRYPTO_GF128MUL tristate "GF(2^128) multiplication functions (EXPERIMENTAL)" @@ -171,6 +161,7 @@ config CRYPTO_AUTHENC config CRYPTO_TEST tristate "Testing module" + depends on m select CRYPTO_MANAGER help Quick & dirty crypto test module. diff --git a/crypto/Makefile b/crypto/Makefile index 69c46ed..ce5a813 100644 --- a/crypto/Makefile +++ b/crypto/Makefile @@ -2,11 +2,6 @@ # Cryptographic API # -ifeq ($(USE_SEC_FIPS_MODE),true) -FIPS=fips_ -endif -obj-$(CONFIG_CRYPTO_FIPS) += fips_integrity.o - obj-$(CONFIG_CRYPTO) += crypto.o crypto-y := api.o cipher.o compress.o diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c index f43b70a..fdc67d3 100644 --- a/crypto/ablkcipher.c +++ b/crypto/ablkcipher.c @@ -50,11 +50,6 @@ void __ablkcipher_walk_complete(struct ablkcipher_walk *walk) { struct ablkcipher_buffer *p, *tmp; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return; -#endif - list_for_each_entry_safe(p, tmp, &walk->buffers, entry) { ablkcipher_buffer_write(p); list_del(&p->entry); @@ -117,11 +112,6 @@ int ablkcipher_walk_done(struct ablkcipher_request *req, struct crypto_tfm *tfm = req->base.tfm; unsigned int nbytes = 0; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - if (likely(err >= 0)) { unsigned int n = walk->nbytes - err; @@ -607,11 +597,6 @@ int crypto_grab_skcipher(struct crypto_skcipher_spawn *spawn, const char *name, struct crypto_alg *alg; int err; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - type = crypto_skcipher_type(type); mask = crypto_skcipher_mask(mask); diff --git a/crypto/ahash.c b/crypto/ahash.c index 5f6a8e4..f669822 100644 --- a/crypto/ahash.c +++ b/crypto/ahash.c @@ -78,11 +78,6 @@ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err) unsigned int alignmask = walk->alignmask; unsigned int nbytes = walk->entrylen; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - walk->data -= walk->offset; if (nbytes && walk->offset & alignmask && !err) { @@ -120,11 +115,6 @@ EXPORT_SYMBOL_GPL(crypto_hash_walk_done); int crypto_hash_walk_first(struct ahash_request *req, struct crypto_hash_walk *walk) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - walk->total = req->nbytes; if (!walk->total) @@ -142,11 +132,6 @@ int crypto_hash_walk_first_compat(struct hash_desc *hdesc, struct crypto_hash_walk *walk, struct scatterlist *sg, unsigned int len) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - walk->total = len; if (!walk->total) @@ -265,11 +250,6 @@ static int crypto_ahash_op(struct ahash_request *req, struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); unsigned long alignmask = crypto_ahash_alignmask(tfm); -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - if ((unsigned long)req->result & alignmask) return ahash_op_unaligned(req, op); @@ -386,11 +366,6 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm) struct crypto_ahash *hash = __crypto_ahash_cast(tfm); struct ahash_alg *alg = crypto_ahash_alg(hash); -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - hash->setkey = ahash_nosetkey; hash->export = ahash_no_export; hash->import = ahash_no_import; @@ -493,11 +468,6 @@ int ahash_register_instance(struct crypto_template *tmpl, { int err; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - err = ahash_prepare_alg(&inst->alg); if (err) return err; diff --git a/crypto/algapi.c b/crypto/algapi.c index 9553f93..d44b156 100644 --- a/crypto/algapi.c +++ b/crypto/algapi.c @@ -61,15 +61,6 @@ static inline int crypto_set_driver_name(struct crypto_alg *alg) static int crypto_check_alg(struct crypto_alg *alg) { -#ifdef CRYPTO_FIPS - if (unlikely(in_fips_err())) { - printk(KERN_ERR - "crypto_check_alg failed due to FIPS error: %s", - alg->cra_name); - return -EACCES; - } -#endif - if (alg->cra_alignmask & (alg->cra_alignmask + 1)) return -EINVAL; @@ -364,15 +355,6 @@ int crypto_register_alg(struct crypto_alg *alg) struct crypto_larval *larval; int err; -#ifdef CRYPTO_FIPS - if (unlikely(in_fips_err())) { - printk(KERN_ERR - "Unable to registrer alg: %s because of FIPS ERROR\n" - , alg->cra_name); - return -EACCES; - } -#endif - err = crypto_check_alg(alg); if (err) return err; @@ -429,11 +411,6 @@ int crypto_register_template(struct crypto_template *tmpl) struct crypto_template *q; int err = -EEXIST; -#ifdef CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - down_write(&crypto_alg_sem); list_for_each_entry(q, &crypto_template_list, list) { @@ -512,11 +489,6 @@ int crypto_register_instance(struct crypto_template *tmpl, struct crypto_larval *larval; int err; -#ifdef CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - err = crypto_check_alg(&inst->alg); if (err) goto err; @@ -552,11 +524,6 @@ int crypto_init_spawn(struct crypto_spawn *spawn, struct crypto_alg *alg, { int err = -EAGAIN; -#ifdef CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - spawn->inst = inst; spawn->mask = mask; @@ -772,11 +739,6 @@ void *crypto_alloc_instance2(const char *name, struct crypto_alg *alg, char *p; int err; -#ifdef CRYPTO_FIPS - if (unlikely(in_fips_err())) - return ERR_PTR(-EACCES); -#endif - p = kzalloc(head + sizeof(*inst) + sizeof(struct crypto_spawn), GFP_KERNEL); if (!p) @@ -808,11 +770,6 @@ struct crypto_instance *crypto_alloc_instance(const char *name, struct crypto_spawn *spawn; int err; - #ifdef CRYPTO_FIPS - if (unlikely(in_fips_err())) - return ERR_PTR(-EACCES); -#endif - inst = crypto_alloc_instance2(name, alg, 0); if (IS_ERR(inst)) goto out; @@ -849,11 +806,6 @@ int crypto_enqueue_request(struct crypto_queue *queue, { int err = -EINPROGRESS; -#ifdef CRYPTO_FIPS - if (unlikely(in_fips_err())) - return ERR_PTR(-EACCES); -#endif - if (unlikely(queue->qlen >= queue->max_qlen)) { err = -EBUSY; if (!(request->flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) @@ -958,13 +910,13 @@ EXPORT_SYMBOL_GPL(crypto_xor); static int __init crypto_algapi_init(void) { - /*crypto_init_proc(); //Moved to testmgr*/ + crypto_init_proc(); return 0; } static void __exit crypto_algapi_exit(void) { - /*crypto_exit_proc(); //Moved to testmgr*/ + crypto_exit_proc(); } module_init(crypto_algapi_init); diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c index e8213b9..ffa0245 100644 --- a/crypto/ansi_cprng.c +++ b/crypto/ansi_cprng.c @@ -126,10 +126,6 @@ static int _get_more_prng_bytes(struct prng_context *ctx, int cont_test) output = ctx->rand_data; break; case 2: -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EINVAL; -#endif /* * First check that we didn't produce the same * random data that we did last time around through this @@ -137,9 +133,8 @@ static int _get_more_prng_bytes(struct prng_context *ctx, int cont_test) if (!memcmp(ctx->rand_data, ctx->last_rand_data, DEFAULT_BLK_SZ)) { if (cont_test) { -#ifdef CONFIG_CRYPTO_FIPS - set_in_fips_err(); -#endif + panic("cprng %p Failed repetition check!\n", + ctx); } printk(KERN_ERR @@ -377,11 +372,6 @@ static int cprng_reset(struct crypto_rng *tfm, u8 *seed, unsigned int slen) if (slen < DEFAULT_PRNG_KSZ + DEFAULT_BLK_SZ) return -EINVAL; -#ifdef CONFIG_CRYPTO_FIPS - if (!memcmp(key, seed, DEFAULT_PRNG_KSZ)) - return -EINVAL; -#endif - if (slen >= (2 * DEFAULT_BLK_SZ + DEFAULT_PRNG_KSZ)) dt = key + DEFAULT_PRNG_KSZ; @@ -418,11 +408,6 @@ static int fips_cprng_get_random(struct crypto_rng *tfm, u8 *rdata, { struct prng_context *prng = crypto_rng_ctx(tfm); -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EINVAL; -#endif - return get_prng_bytes(rdata, dlen, prng, 1); } diff --git a/crypto/api.c b/crypto/api.c index b7ecbdf..4f98dd5 100644 --- a/crypto/api.c +++ b/crypto/api.c @@ -366,11 +366,6 @@ struct crypto_tfm *__crypto_alloc_tfm(struct crypto_alg *alg, u32 type, unsigned int tfm_size; int err = -ENOMEM; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return ERR_PTR(-EACCES); -#endif - tfm_size = sizeof(*tfm) + crypto_ctxsize(alg, type, mask); tfm = kzalloc(tfm_size, GFP_KERNEL); if (tfm == NULL) @@ -427,11 +422,6 @@ struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask) struct crypto_tfm *tfm; int err; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return ERR_PTR(-EACCES); -#endif - for (;;) { struct crypto_alg *alg; @@ -470,13 +460,6 @@ void *crypto_create_tfm(struct crypto_alg *alg, unsigned int total; int err = -ENOMEM; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) { - printk(KERN_ERR - "Fail crypto_create_tfm due to fips error state.\n"); - return ERR_PTR(-EACCES); - } -#endif tfmsize = frontend->tfmsize; total = tfmsize + sizeof(*tfm) + frontend->extsize(alg); @@ -556,11 +539,6 @@ void *crypto_alloc_tfm(const char *alg_name, void *tfm; int err; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return ERR_PTR(-EACCES); -#endif - for (;;) { struct crypto_alg *alg; diff --git a/crypto/fips_integrity.c b/crypto/fips_integrity.c deleted file mode 100644 index 2a51f92..0000000 --- a/crypto/fips_integrity.c +++ /dev/null @@ -1,76 +0,0 @@ -/* - * Integrity check code for crypto module. - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2 of the License, or (at your option) - * any later version. - * - */ -#include <crypto/hash.h> -#include <crypto/sha.h> -#include <linux/err.h> -#include <linux/scatterlist.h> -#include <asm-generic/sections.h> - -#include "internal.h" - -#define ZIMAGE_ADDR (_stext + CONFIG_CRYPTO_FIPS_INTEG_OFFSET) - -static bool need_integrity_check = true; - -void do_integrity_check(void) -{ - u8 *rbuf = (u8 *) ZIMAGE_ADDR; - u32 len; - u8 hmac[SHA256_DIGEST_SIZE]; - struct hash_desc desc; - struct scatterlist sg; - u8 *key = "12345678"; - - printk(KERN_INFO "FIPS: do kernel integrity check\n"); - - if (unlikely(!need_integrity_check || in_fips_err())) - return; - - if (*((u32 *) &rbuf[36]) != 0x016F2818) { - printk(KERN_ERR "FIPS: invalid zImage magic number."); - set_in_fips_err(); - goto err1; - } - - if (*(u32 *) &rbuf[44] <= *(u32 *) &rbuf[40]) { - printk(KERN_ERR "FIPS: invalid zImage calculated len"); - set_in_fips_err(); - goto err1; - } - - len = *(u32 *) &rbuf[44] - *(u32 *) &rbuf[40]; - - desc.tfm = crypto_alloc_hash("hmac(sha256)", 0, 0); - - if (IS_ERR(desc.tfm)) { - printk(KERN_ERR "FIPS: integ failed to allocate tfm %ld\n", - PTR_ERR(desc.tfm)); - set_in_fips_err(); - goto err; - } - - sg_init_one(&sg, rbuf, len); - crypto_hash_setkey(desc.tfm, key, strlen(key)); - crypto_hash_digest(&desc, &sg, len, hmac); - - if (!strncmp(hmac, &rbuf[len], SHA256_DIGEST_SIZE)) { - printk(KERN_INFO "FIPS: integrity check passed\n"); - } else { - printk(KERN_ERR "FIPS: integrity check failed\n"); - set_in_fips_err(); - } - - err: - crypto_free_hash(desc.tfm); - err1: - need_integrity_check = false; - - return; -} diff --git a/crypto/internal.h b/crypto/internal.h index 0e7e9fd..d4384b0 100644 --- a/crypto/internal.h +++ b/crypto/internal.h @@ -51,14 +51,7 @@ extern struct rw_semaphore crypto_alg_sem; extern struct blocking_notifier_head crypto_chain; #ifdef CONFIG_PROC_FS -#ifdef CONFIG_CRYPTO_FIPS -void set_in_fips_err(void); -void __init crypto_init_proc(int *fips_error); -void do_integrity_check(void); -int testmgr_crypto_proc_init(void); -#else void __init crypto_init_proc(void); -#endif void __exit crypto_exit_proc(void); #else static inline void crypto_init_proc(void) @@ -145,3 +138,4 @@ static inline void crypto_notify(unsigned long val, void *v) } #endif /* _CRYPTO_INTERNAL_H */ + diff --git a/crypto/proc.c b/crypto/proc.c index 2c0b607..58fef67 100644 --- a/crypto/proc.c +++ b/crypto/proc.c @@ -25,7 +25,8 @@ #ifdef CONFIG_CRYPTO_FIPS static struct ctl_table crypto_sysctl_table[] = { { - .procname = "fips_status", + .procname = "fips_enabled", + .data = &fips_enabled, .maxlen = sizeof(int), .mode = 0444, .proc_handler = proc_dointvec @@ -140,20 +141,11 @@ static const struct file_operations proc_crypto_ops = { .release = seq_release }; -#ifdef CONFIG_CRYPTO_FIPS -void __init crypto_init_proc(int *fips_error) -{ - proc_create("crypto", 0, NULL, &proc_crypto_ops); - crypto_sysctl_table[0].data = fips_error; - crypto_proc_fips_init(); -} -#else void __init crypto_init_proc(void) { proc_create("crypto", 0, NULL, &proc_crypto_ops); crypto_proc_fips_init(); } -#endif void __exit crypto_exit_proc(void) { diff --git a/crypto/shash.c b/crypto/shash.c index e44549c..76f74b9 100644 --- a/crypto/shash.c +++ b/crypto/shash.c @@ -99,11 +99,6 @@ int crypto_shash_update(struct shash_desc *desc, const u8 *data, struct shash_alg *shash = crypto_shash_alg(tfm); unsigned long alignmask = crypto_shash_alignmask(tfm); -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - if ((unsigned long)data & alignmask) return shash_update_unaligned(desc, data, len); @@ -139,11 +134,6 @@ int crypto_shash_final(struct shash_desc *desc, u8 *out) struct shash_alg *shash = crypto_shash_alg(tfm); unsigned long alignmask = crypto_shash_alignmask(tfm); -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - if ((unsigned long)out & alignmask) return shash_final_unaligned(desc, out); @@ -165,11 +155,6 @@ int crypto_shash_finup(struct shash_desc *desc, const u8 *data, struct shash_alg *shash = crypto_shash_alg(tfm); unsigned long alignmask = crypto_shash_alignmask(tfm); -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - if (((unsigned long)data | (unsigned long)out) & alignmask) return shash_finup_unaligned(desc, data, len, out); @@ -191,11 +176,6 @@ int crypto_shash_digest(struct shash_desc *desc, const u8 *data, struct shash_alg *shash = crypto_shash_alg(tfm); unsigned long alignmask = crypto_shash_alignmask(tfm); -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - if (((unsigned long)data | (unsigned long)out) & alignmask) return shash_digest_unaligned(desc, data, len, out); @@ -228,11 +208,6 @@ static int shash_async_init(struct ahash_request *req) struct crypto_shash **ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(req)); struct shash_desc *desc = ahash_request_ctx(req); -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - desc->tfm = *ctx; desc->flags = req->base.flags; @@ -244,11 +219,6 @@ int shash_ahash_update(struct ahash_request *req, struct shash_desc *desc) struct crypto_hash_walk walk; int nbytes; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - for (nbytes = crypto_hash_walk_first(req, &walk); nbytes > 0; nbytes = crypto_hash_walk_done(&walk, nbytes)) nbytes = crypto_shash_update(desc, walk.data, nbytes); @@ -272,11 +242,6 @@ int shash_ahash_finup(struct ahash_request *req, struct shash_desc *desc) struct crypto_hash_walk walk; int nbytes; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - nbytes = crypto_hash_walk_first(req, &walk); if (!nbytes) return crypto_shash_final(desc, req->result); @@ -311,11 +276,6 @@ int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc) unsigned int nbytes = req->nbytes; int err; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) { void *data; @@ -374,11 +334,6 @@ int crypto_init_shash_ops_async(struct crypto_tfm *tfm) struct crypto_shash **ctx = crypto_tfm_ctx(tfm); struct crypto_shash *shash; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - if (!crypto_mod_get(calg)) return -EAGAIN; @@ -595,11 +550,6 @@ static const struct crypto_type crypto_shash_type = { struct crypto_shash *crypto_alloc_shash(const char *alg_name, u32 type, u32 mask) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return ERR_PTR(-EACCES); -#endif - return crypto_alloc_tfm(alg_name, &crypto_shash_type, type, mask); } EXPORT_SYMBOL_GPL(crypto_alloc_shash); @@ -637,11 +587,6 @@ int crypto_register_shash(struct shash_alg *alg) struct crypto_alg *base = &alg->base; int err; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - err = shash_prepare_alg(alg); if (err) return err; @@ -661,11 +606,6 @@ int shash_register_instance(struct crypto_template *tmpl, { int err; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - err = shash_prepare_alg(&inst->alg); if (err) return err; @@ -685,11 +625,6 @@ int crypto_init_shash_spawn(struct crypto_shash_spawn *spawn, struct shash_alg *alg, struct crypto_instance *inst) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_init_spawn2(&spawn->base, &alg->base, inst, &crypto_shash_type); } diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c index 093764e..2222617 100644 --- a/crypto/tcrypt.c +++ b/crypto/tcrypt.c @@ -33,12 +33,9 @@ #include <linux/jiffies.h> #include <linux/timex.h> #include <linux/interrupt.h> -#ifdef CRYPTO_SPEED_TESTS #include "tcrypt.h" -#endif #include "internal.h" -#ifdef CRYPTO_SPEED_TESTS /* * Need slab memory for testing (size in number of pages). */ @@ -54,15 +51,12 @@ * Used by test_cipher_speed() */ static unsigned int sec; -#endif static char *alg = NULL; static u32 type; static u32 mask; static int mode; -#ifdef CRYPTO_SPEED_TESTS static char *tvmem[TVMEMSIZE]; -#endif static char *check[] = { "des", "md5", "des3_ede", "rot13", "sha1", "sha224", "sha256", @@ -72,7 +66,7 @@ static char *check[] = { "camellia", "seed", "salsa20", "rmd128", "rmd160", "rmd256", "rmd320", "lzo", "cts", "zlib", NULL }; -#ifdef CRYPTO_SPEED_TESTS + static int test_cipher_jiffies(struct blkcipher_desc *desc, int enc, struct scatterlist *sg, int blen, int sec) { @@ -724,7 +718,6 @@ static void test_ahash_speed(const char *algo, unsigned int sec, out: crypto_free_ahash(tfm); } -#endif static void test_available(void) { @@ -759,17 +752,15 @@ static int do_test(int m) for (i = 1; i < 200; i++) ret += do_test(i); break; -#ifdef CONFIG_CRYPTO_MD5 + case 1: ret += tcrypt_test("md5"); break; -#endif -#ifdef CONFIG_CRYPTO_SHA1 + case 2: ret += tcrypt_test("sha1"); break; -#endif -#ifdef CONFIG_CRYPTO_DES + case 3: ret += tcrypt_test("ecb(des)"); ret += tcrypt_test("cbc(des)"); @@ -779,47 +770,38 @@ static int do_test(int m) ret += tcrypt_test("ecb(des3_ede)"); ret += tcrypt_test("cbc(des3_ede)"); break; -#endif -#ifdef CONFIG_CRYPTO_MD4 + case 5: ret += tcrypt_test("md4"); break; -#endif + case 6: ret += tcrypt_test("sha256"); break; -#ifdef CONFIG_CRYPTO_BLOWFISH + case 7: ret += tcrypt_test("ecb(blowfish)"); ret += tcrypt_test("cbc(blowfish)"); break; -#endif -#ifdef CONFIG_CRYPTO_TWOFISH + case 8: ret += tcrypt_test("ecb(twofish)"); ret += tcrypt_test("cbc(twofish)"); break; -#endif -#ifdef CONFIG_CRYPTO_SERPENT + case 9: ret += tcrypt_test("ecb(serpent)"); break; -#endif + case 10: ret += tcrypt_test("ecb(aes)"); ret += tcrypt_test("cbc(aes)"); -#ifdef CONFIG_CRYPTO_LRW ret += tcrypt_test("lrw(aes)"); -#endif -#ifdef CONFIG_CRYPTO_XTS ret += tcrypt_test("xts(aes)"); -#endif -#ifdef CONFIG_CRYPTO_CTR ret += tcrypt_test("ctr(aes)"); ret += tcrypt_test("rfc3686(ctr(aes))"); break; -#endif -#ifdef CONFIG_CRYPTO_SHA512 + case 11: ret += tcrypt_test("sha384"); break; @@ -827,34 +809,31 @@ static int do_test(int m) case 12: ret += tcrypt_test("sha512"); break; -#endif -#ifdef CONFIG_CRYPTO_DEFLATE + case 13: ret += tcrypt_test("deflate"); break; -#endif -#ifdef CONFIG_CRYPTO_CAST5 + case 14: ret += tcrypt_test("ecb(cast5)"); break; -#endif -#ifdef CONFIG_CRYPTO_CAST6 + case 15: ret += tcrypt_test("ecb(cast6)"); break; -#endif + case 16: ret += tcrypt_test("ecb(arc4)"); break; -#ifdef CONFIG_CRYPTO_MICHAEL_MIC + case 17: ret += tcrypt_test("michael_mic"); break; -#endif + case 18: ret += tcrypt_test("crc32c"); break; -#ifdef CONFIG_CRYPTO_TEA + case 19: ret += tcrypt_test("ecb(tea)"); break; @@ -862,13 +841,11 @@ static int do_test(int m) case 20: ret += tcrypt_test("ecb(xtea)"); break; -#endif -#ifdef CONFIG_CRYPTO_KHAZAD + case 21: ret += tcrypt_test("ecb(khazad)"); break; -#endif -#ifdef CONFIG_CRYPTO_WP512 + case 22: ret += tcrypt_test("wp512"); break; @@ -880,19 +857,16 @@ static int do_test(int m) case 24: ret += tcrypt_test("wp256"); break; -#endif -#ifdef CONFIG_CRYPTO_SERPENT + case 25: ret += tcrypt_test("ecb(tnepres)"); break; -#endif -#ifdef CONFIG_CRYPTO_ANUBIS + case 26: ret += tcrypt_test("ecb(anubis)"); ret += tcrypt_test("cbc(anubis)"); break; -#endif -#ifdef CONFIG_CRYPTO_TGR192 + case 27: ret += tcrypt_test("tgr192"); break; @@ -905,100 +879,83 @@ static int do_test(int m) case 29: ret += tcrypt_test("tgr128"); break; -#endif -#ifdef CONFIG_CRYPTO_TEA + case 30: ret += tcrypt_test("ecb(xeta)"); break; -#endif -#ifdef CONFIG_CRYPTO_FCRYPT + case 31: ret += tcrypt_test("pcbc(fcrypt)"); break; -#endif -#ifdef CONFIG_CRYPTO_CAMELLIA + case 32: ret += tcrypt_test("ecb(camellia)"); ret += tcrypt_test("cbc(camellia)"); break; -#endif case 33: ret += tcrypt_test("sha224"); break; -#ifdef CONFIG_CRYPTO_SALSA20 + case 34: ret += tcrypt_test("salsa20"); break; -#endif -#ifdef CONFIG_CRYPTO_GCM + case 35: ret += tcrypt_test("gcm(aes)"); break; -#endif -#ifdef CONFIG_CRYPTO_LZO + case 36: ret += tcrypt_test("lzo"); break; -#endif -#ifdef CONFIG_CRYPTO_CCM + case 37: ret += tcrypt_test("ccm(aes)"); break; -#endif -#ifdef CONFIG_CRYPTO_CTS + case 38: ret += tcrypt_test("cts(cbc(aes))"); break; -#endif -#ifdef CONFIG_CRYPTO_RMD128 + case 39: ret += tcrypt_test("rmd128"); break; -#endif -#ifdef CONFIG_CRYPTO_RMD160 + case 40: ret += tcrypt_test("rmd160"); break; -#endif -#ifdef CONFIG_CRYPTO_RMD256 + case 41: ret += tcrypt_test("rmd256"); break; -#endif -#ifdef CONFIG_CRYPTO_RMD320 + case 42: ret += tcrypt_test("rmd320"); break; -#endif -#ifdef CONFIG_CRYPTO_SEED + case 43: ret += tcrypt_test("ecb(seed)"); break; -#endif -#ifdef CONFIG_CRYPTO_ZLIB + case 44: ret += tcrypt_test("zlib"); break; -#endif -#ifdef CONFIG_CRYPTO_CCM + case 45: ret += tcrypt_test("rfc4309(ccm(aes))"); break; -#endif -#ifdef CONFIG_CRYPTO_MD5 + case 100: ret += tcrypt_test("hmac(md5)"); break; -#endif -#ifdef CONFIG_CRYPTO_SHA1 + case 101: ret += tcrypt_test("hmac(sha1)"); break; -#endif + case 102: ret += tcrypt_test("hmac(sha256)"); break; -#ifdef CONFIG_CRYPTO_SHA512 + case 103: ret += tcrypt_test("hmac(sha384)"); break; @@ -1006,16 +963,15 @@ static int do_test(int m) case 104: ret += tcrypt_test("hmac(sha512)"); break; -#endif + case 105: ret += tcrypt_test("hmac(sha224)"); break; -#ifdef CONFIG_CRYPTO_XCBC + case 106: ret += tcrypt_test("xcbc(aes)"); break; -#endif -#ifdef CONFIG_CRYPTO_RMD + case 107: ret += tcrypt_test("hmac(rmd128)"); break; @@ -1023,23 +979,19 @@ static int do_test(int m) case 108: ret += tcrypt_test("hmac(rmd160)"); break; -#endif -#ifdef CONFIG_CRYPTO_VMAC + case 109: ret += tcrypt_test("vmac(aes)"); break; -#endif + case 150: ret += tcrypt_test("ansi_cprng"); break; -#ifdef CONFIG_CRYPTO_GCM case 151: ret += tcrypt_test("rfc4106(gcm(aes))"); break; -#endif -#ifdef CRYPTO_SPEED_TESTS case 200: test_cipher_speed("ecb(aes)", ENCRYPT, sec, NULL, 0, speed_template_16_24_32); @@ -1278,7 +1230,7 @@ static int do_test(int m) case 499: break; -#endif + case 1000: test_available(); break; @@ -1296,7 +1248,6 @@ static int do_alg_test(const char *alg, u32 type, u32 mask) static int __init tcrypt_mod_init(void) { int err = -ENOMEM; -#ifdef CRYPTO_SPEED_TESTS int i; for (i = 0; i < TVMEMSIZE; i++) { @@ -1304,9 +1255,6 @@ static int __init tcrypt_mod_init(void) if (!tvmem[i]) goto err_free_tv; } -#endif - - testmgr_crypto_proc_init(); if (alg) err = do_alg_test(alg, type, mask); @@ -1316,12 +1264,8 @@ static int __init tcrypt_mod_init(void) if (err) { printk(KERN_ERR "tcrypt: one or more tests failed!\n"); goto err_free_tv; -#ifndef CONFIG_CRYPTO_FIPS } -#else - } else - do_integrity_check(); -#endif + /* We intentionaly return -EAGAIN to prevent keeping the module, * unless we're running in fips mode. It does all its work from * init() and doesn't offer any runtime functionality, but in @@ -1333,10 +1277,9 @@ static int __init tcrypt_mod_init(void) err = -EAGAIN; err_free_tv: -#ifdef CRYPTO_SPEED_TESTS for (i = 0; i < TVMEMSIZE && tvmem[i]; i++) free_page((unsigned long)tvmem[i]); -#endif + return err; } @@ -1353,11 +1296,10 @@ module_param(alg, charp, 0); module_param(type, uint, 0); module_param(mask, uint, 0); module_param(mode, int, 0); -#ifdef SUPPORT_SPEED_TEST module_param(sec, uint, 0); MODULE_PARM_DESC(sec, "Length in seconds of speed tests " "(defaults to zero which uses CPU cycles instead)"); -#endif + MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("Quick & dirty crypto testing module"); MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>"); diff --git a/crypto/testmgr.c b/crypto/testmgr.c index 3a914c7..b6b93d4 100644 --- a/crypto/testmgr.c +++ b/crypto/testmgr.c @@ -30,7 +30,7 @@ #include "internal.h" -#ifndef CONFIG_CRYPTO_MANAGER_TESTS +#ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS /* a perfect nop */ int alg_test(const char *driver, const char *alg, u32 type, u32 mask) @@ -38,14 +38,6 @@ int alg_test(const char *driver, const char *alg, u32 type, u32 mask) return 0; } -#ifdef CONFIG_CRYPTO_FIPS -bool in_fips_err() -{ - return false; -} -EXPORT_SYMBOL_GPL(in_fips_err); -#endif - #else #include "testmgr.h" @@ -73,12 +65,6 @@ EXPORT_SYMBOL_GPL(in_fips_err); #define ENCRYPT 1 #define DECRYPT 0 -#ifdef CONFIG_CRYPTO_FIPS -#define FIPS_ERR 1 -#define FIPS_NO_ERR 0 -static int IN_FIPS_ERROR = FIPS_NO_ERR; -#endif - struct tcrypt_result { struct completion completion; int err; @@ -140,19 +126,6 @@ struct alg_test_desc { static unsigned int IDX[8] = { IDX1, IDX2, IDX3, IDX4, IDX5, IDX6, IDX7, IDX8 }; -#ifdef CONFIG_CRYPTO_FIPS -bool in_fips_err() -{ - return (IN_FIPS_ERROR == FIPS_ERR); -} -EXPORT_SYMBOL_GPL(in_fips_err); - -void set_in_fips_err() -{ - IN_FIPS_ERROR = FIPS_ERR; -} -#endif - static void hexdump(unsigned char *buf, unsigned int len) { print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET, @@ -1719,9 +1692,7 @@ static const struct alg_test_desc alg_test_descs[] = { }, { .alg = "ccm(aes)", .test = alg_test_aead, -#ifdef CONFIG_CRYPTO_CCM .fips_allowed = 1, -#endif .suite = { .aead = { .enc = { @@ -2090,9 +2061,7 @@ static const struct alg_test_desc alg_test_descs[] = { }, { .alg = "gcm(aes)", .test = alg_test_aead, -#ifdef CONFIG_CRYPTO_GCM .fips_allowed = 1, -#endif .suite = { .aead = { .enc = { @@ -2108,6 +2077,7 @@ static const struct alg_test_desc alg_test_descs[] = { }, { .alg = "ghash", .test = alg_test_hash, + .fips_allowed = 1, .suite = { .hash = { .vecs = ghash_tv_template, @@ -2298,9 +2268,6 @@ static const struct alg_test_desc alg_test_descs[] = { }, { .alg = "rfc4106(gcm(aes))", .test = alg_test_aead, -#ifdef CONFIG_CRYPTO_GCM - .fips_allowed = 1, -#endif .suite = { .aead = { .enc = { @@ -2318,9 +2285,7 @@ static const struct alg_test_desc alg_test_descs[] = { .alg = "rfc4309(ccm(aes))", .test = alg_test_aead, -#ifdef CONFIG_CRYPTO_CCM .fips_allowed = 1, -#endif .suite = { .aead = { .enc = { @@ -2565,10 +2530,7 @@ int alg_test(const char *driver, const char *alg, u32 type, u32 mask) { int i; int j; - int rc = 0; -#ifdef CONFIG_CRYPTO_FIPS - fips_enabled = 1; -#endif + int rc; if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_CIPHER) { char nalg[CRYPTO_MAX_ALG_NAME]; @@ -2593,6 +2555,11 @@ int alg_test(const char *driver, const char *alg, u32 type, u32 mask) if (i < 0 && j < 0) goto notest; + if (fips_enabled && ((i >= 0 && !alg_test_descs[i].fips_allowed) || + (j >= 0 && !alg_test_descs[j].fips_allowed))) + goto non_fips_alg; + + rc = 0; if (i >= 0) rc |= alg_test_descs[i].test(alg_test_descs + i, driver, type, mask); @@ -2600,52 +2567,23 @@ int alg_test(const char *driver, const char *alg, u32 type, u32 mask) rc |= alg_test_descs[j].test(alg_test_descs + j, driver, type, mask); - if (fips_enabled && ((i >= 0 && !alg_test_descs[i].fips_allowed) || - (j >= 0 && !alg_test_descs[j].fips_allowed))) - goto non_fips_alg; - test_done: - if (fips_enabled && rc) { - printk(KERN_INFO - "FIPS: %s: %s alg self test failed\n", - driver, alg); -#ifdef CONFIG_CRYPTO_FIPS - IN_FIPS_ERROR = FIPS_ERR; -#endif - return rc; - } + if (fips_enabled && rc) + panic("%s: %s alg self test failed in fips mode!\n", driver, alg); if (fips_enabled && !rc) - printk(KERN_INFO "FIPS: self-tests for %s (%s) passed\n", - driver, alg); + printk(KERN_INFO "alg: self-tests for %s (%s) passed\n", + driver, alg); return rc; notest: - printk(KERN_INFO "FIPS: No test for %s (%s)\n", alg, driver); + printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver); return 0; non_fips_alg: - if (!rc) - printk(KERN_INFO - "FIPS: self-tests for non-FIPS %s (%s) passed\n", - driver, alg); - else - printk(KERN_INFO - "FIPS: self-tests for non-FIPS %s (%s) failed\n", - alg, driver); - return rc; -} - -int testmgr_crypto_proc_init(void) -{ -#ifdef CONFIG_CRYPTO_FIPS - crypto_init_proc(&IN_FIPS_ERROR); -#else - crypto_init_proc(); -#endif - return 0; + return -EINVAL; } -#endif /* CONFIG_CRYPTO_MANAGER_TESTS */ +#endif /* CONFIG_CRYPTO_MANAGER_DISABLE_TESTS */ EXPORT_SYMBOL_GPL(alg_test); diff --git a/include/crypto/aead.h b/include/crypto/aead.h index 2281408..0edf949 100644 --- a/include/crypto/aead.h +++ b/include/crypto/aead.h @@ -1,11 +1,11 @@ /* * AEAD: Authenticated Encryption with Associated Data - * + * * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2 of the License, or (at your option) + * Software Foundation; either version 2 of the License, or (at your option) * any later version. * */ @@ -39,24 +39,12 @@ static inline struct crypto_aead *aead_givcrypt_reqtfm( static inline int crypto_aead_givencrypt(struct aead_givcrypt_request *req) { struct aead_tfm *crt = crypto_aead_crt(aead_givcrypt_reqtfm(req)); - -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crt->givencrypt(req); }; static inline int crypto_aead_givdecrypt(struct aead_givcrypt_request *req) { struct aead_tfm *crt = crypto_aead_crt(aead_givcrypt_reqtfm(req)); - -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crt->givdecrypt(req); }; @@ -71,11 +59,6 @@ static inline struct aead_givcrypt_request *aead_givcrypt_alloc( { struct aead_givcrypt_request *req; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return NULL; -#endif - req = kmalloc(sizeof(struct aead_givcrypt_request) + crypto_aead_reqsize(tfm), gfp); diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h index 1f40265..59c3e5b 100644 --- a/include/crypto/algapi.h +++ b/include/crypto/algapi.h @@ -304,7 +304,6 @@ static inline void blkcipher_walk_init(struct blkcipher_walk *walk, walk->in.sg = src; walk->out.sg = dst; walk->total = nbytes; - walk->flags = 0; } static inline void ablkcipher_walk_init(struct ablkcipher_walk *walk, diff --git a/include/crypto/compress.h b/include/crypto/compress.h index 607ba7d..86163ef 100644 --- a/include/crypto/compress.h +++ b/include/crypto/compress.h @@ -99,86 +99,46 @@ static inline struct pcomp_alg *crypto_pcomp_alg(struct crypto_pcomp *tfm) static inline int crypto_compress_setup(struct crypto_pcomp *tfm, void *params, unsigned int len) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_pcomp_alg(tfm)->compress_setup(tfm, params, len); } static inline int crypto_compress_init(struct crypto_pcomp *tfm) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_pcomp_alg(tfm)->compress_init(tfm); } static inline int crypto_compress_update(struct crypto_pcomp *tfm, struct comp_request *req) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_pcomp_alg(tfm)->compress_update(tfm, req); } static inline int crypto_compress_final(struct crypto_pcomp *tfm, struct comp_request *req) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_pcomp_alg(tfm)->compress_final(tfm, req); } static inline int crypto_decompress_setup(struct crypto_pcomp *tfm, void *params, unsigned int len) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_pcomp_alg(tfm)->decompress_setup(tfm, params, len); } static inline int crypto_decompress_init(struct crypto_pcomp *tfm) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_pcomp_alg(tfm)->decompress_init(tfm); } static inline int crypto_decompress_update(struct crypto_pcomp *tfm, struct comp_request *req) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_pcomp_alg(tfm)->decompress_update(tfm, req); } static inline int crypto_decompress_final(struct crypto_pcomp *tfm, struct comp_request *req) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_pcomp_alg(tfm)->decompress_final(tfm, req); } diff --git a/include/crypto/hash.h b/include/crypto/hash.h index 7029716..26cb1eb 100644 --- a/include/crypto/hash.h +++ b/include/crypto/hash.h @@ -1,11 +1,11 @@ /* * Hash: Hash algorithms under the crypto API - * + * * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au> * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2 of the License, or (at your option) + * Software Foundation; either version 2 of the License, or (at your option) * any later version. * */ @@ -197,21 +197,11 @@ static inline int crypto_ahash_import(struct ahash_request *req, const void *in) static inline int crypto_ahash_init(struct ahash_request *req) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_ahash_reqtfm(req)->init(req); } static inline int crypto_ahash_update(struct ahash_request *req) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_ahash_reqtfm(req)->update(req); } @@ -226,11 +216,6 @@ static inline struct ahash_request *ahash_request_alloc( { struct ahash_request *req; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return NULL; -#endif - req = kmalloc(sizeof(struct ahash_request) + crypto_ahash_reqsize(tfm), gfp); @@ -346,31 +331,16 @@ int crypto_shash_digest(struct shash_desc *desc, const u8 *data, static inline int crypto_shash_export(struct shash_desc *desc, void *out) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_shash_alg(desc->tfm)->export(desc, out); } static inline int crypto_shash_import(struct shash_desc *desc, const void *in) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_shash_alg(desc->tfm)->import(desc, in); } static inline int crypto_shash_init(struct shash_desc *desc) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_shash_alg(desc->tfm)->init(desc); } diff --git a/include/crypto/rng.h b/include/crypto/rng.h index 74db6da..c93f9b9 100644 --- a/include/crypto/rng.h +++ b/include/crypto/rng.h @@ -58,11 +58,6 @@ static inline void crypto_free_rng(struct crypto_rng *tfm) static inline int crypto_rng_get_bytes(struct crypto_rng *tfm, u8 *rdata, unsigned int dlen) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_rng_crt(tfm)->rng_gen_random(tfm, rdata, dlen); } diff --git a/include/crypto/skcipher.h b/include/crypto/skcipher.h index c893e78..25fd612 100644 --- a/include/crypto/skcipher.h +++ b/include/crypto/skcipher.h @@ -1,11 +1,11 @@ /* * Symmetric key ciphers. - * + * * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2 of the License, or (at your option) + * Software Foundation; either version 2 of the License, or (at your option) * any later version. * */ @@ -41,10 +41,6 @@ static inline int crypto_skcipher_givencrypt( { struct ablkcipher_tfm *crt = crypto_ablkcipher_crt(skcipher_givcrypt_reqtfm(req)); -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif return crt->givencrypt(req); }; @@ -53,10 +49,6 @@ static inline int crypto_skcipher_givdecrypt( { struct ablkcipher_tfm *crt = crypto_ablkcipher_crt(skcipher_givcrypt_reqtfm(req)); -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif return crt->givdecrypt(req); }; @@ -78,11 +70,6 @@ static inline struct skcipher_givcrypt_request *skcipher_givcrypt_alloc( { struct skcipher_givcrypt_request *req; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return NULL; -#endif - req = kmalloc(sizeof(struct skcipher_givcrypt_request) + crypto_ablkcipher_reqsize(tfm), gfp); @@ -120,3 +107,4 @@ static inline void skcipher_givcrypt_set_giv( } #endif /* _CRYPTO_SKCIPHER_H */ + diff --git a/include/linux/crypto.h b/include/linux/crypto.h index 408bcb4..a6a7a1c 100644 --- a/include/linux/crypto.h +++ b/include/linux/crypto.h @@ -7,10 +7,10 @@ * * Portions derived from Cryptoapi, by Alexander Kjeldaas <astor@fast.no> * and Nettle, by Niels Möller. - * + * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2 of the License, or (at your option) + * Software Foundation; either version 2 of the License, or (at your option) * any later version. * */ @@ -25,9 +25,6 @@ #include <linux/string.h> #include <linux/uaccess.h> -#ifdef CONFIG_CRYPTO_FIPS -#include <linux/err.h> -#endif /* * Algorithm masks and types. */ @@ -84,10 +81,10 @@ #define CRYPTO_TFM_REQ_MAY_SLEEP 0x00000200 #define CRYPTO_TFM_REQ_MAY_BACKLOG 0x00000400 #define CRYPTO_TFM_RES_WEAK_KEY 0x00100000 -#define CRYPTO_TFM_RES_BAD_KEY_LEN 0x00200000 -#define CRYPTO_TFM_RES_BAD_KEY_SCHED 0x00400000 -#define CRYPTO_TFM_RES_BAD_BLOCK_LEN 0x00800000 -#define CRYPTO_TFM_RES_BAD_FLAGS 0x01000000 +#define CRYPTO_TFM_RES_BAD_KEY_LEN 0x00200000 +#define CRYPTO_TFM_RES_BAD_KEY_SCHED 0x00400000 +#define CRYPTO_TFM_RES_BAD_BLOCK_LEN 0x00800000 +#define CRYPTO_TFM_RES_BAD_FLAGS 0x01000000 /* * Miscellaneous stuff. @@ -106,10 +103,6 @@ #define CRYPTO_MINALIGN_ATTR __attribute__ ((__aligned__(CRYPTO_MINALIGN))) -#ifdef CONFIG_CRYPTO_FIPS -bool in_fips_err(void); -#endif - struct scatterlist; struct crypto_ablkcipher; struct crypto_async_request; @@ -303,7 +296,7 @@ struct crypto_alg { int (*cra_init)(struct crypto_tfm *tfm); void (*cra_exit)(struct crypto_tfm *tfm); void (*cra_destroy)(struct crypto_alg *alg); - + struct module *cra_module; }; @@ -408,7 +401,7 @@ struct rng_tfm { struct crypto_tfm { u32 crt_flags; - + union { struct ablkcipher_tfm ablkcipher; struct aead_tfm aead; @@ -420,7 +413,7 @@ struct crypto_tfm { } crt_u; void (*exit)(struct crypto_tfm *tfm); - + struct crypto_alg *__crt_alg; void *__crt_ctx[] CRYPTO_MINALIGN_ATTR; @@ -480,10 +473,10 @@ struct crypto_attr_u32 { u32 num; }; -/* +/* * Transform user interface. */ - + struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask); void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm); @@ -661,11 +654,6 @@ static inline int crypto_ablkcipher_encrypt(struct ablkcipher_request *req) { struct ablkcipher_tfm *crt = crypto_ablkcipher_crt(crypto_ablkcipher_reqtfm(req)); - -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif return crt->encrypt(req); } @@ -673,12 +661,6 @@ static inline int crypto_ablkcipher_decrypt(struct ablkcipher_request *req) { struct ablkcipher_tfm *crt = crypto_ablkcipher_crt(crypto_ablkcipher_reqtfm(req)); - -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crt->decrypt(req); } @@ -705,11 +687,6 @@ static inline struct ablkcipher_request *ablkcipher_request_alloc( { struct ablkcipher_request *req; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return NULL; -#endif - req = kmalloc(sizeof(struct ablkcipher_request) + crypto_ablkcipher_reqsize(tfm), gfp); @@ -818,21 +795,11 @@ static inline struct crypto_aead *crypto_aead_reqtfm(struct aead_request *req) static inline int crypto_aead_encrypt(struct aead_request *req) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_aead_crt(crypto_aead_reqtfm(req))->encrypt(req); } static inline int crypto_aead_decrypt(struct aead_request *req) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_aead_crt(crypto_aead_reqtfm(req))->decrypt(req); } @@ -852,11 +819,6 @@ static inline struct aead_request *aead_request_alloc(struct crypto_aead *tfm, { struct aead_request *req; -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return NULL; -#endif - req = kmalloc(sizeof(*req) + crypto_aead_reqsize(tfm), gfp); if (likely(req)) @@ -1005,11 +967,6 @@ static inline int crypto_blkcipher_encrypt(struct blkcipher_desc *desc, struct scatterlist *src, unsigned int nbytes) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - desc->info = crypto_blkcipher_crt(desc->tfm)->iv; return crypto_blkcipher_crt(desc->tfm)->encrypt(desc, dst, src, nbytes); } @@ -1019,11 +976,6 @@ static inline int crypto_blkcipher_encrypt_iv(struct blkcipher_desc *desc, struct scatterlist *src, unsigned int nbytes) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_blkcipher_crt(desc->tfm)->encrypt(desc, dst, src, nbytes); } @@ -1032,11 +984,6 @@ static inline int crypto_blkcipher_decrypt(struct blkcipher_desc *desc, struct scatterlist *src, unsigned int nbytes) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - desc->info = crypto_blkcipher_crt(desc->tfm)->iv; return crypto_blkcipher_crt(desc->tfm)->decrypt(desc, dst, src, nbytes); } @@ -1046,11 +993,6 @@ static inline int crypto_blkcipher_decrypt_iv(struct blkcipher_desc *desc, struct scatterlist *src, unsigned int nbytes) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_blkcipher_crt(desc->tfm)->decrypt(desc, dst, src, nbytes); } @@ -1148,11 +1090,6 @@ static inline int crypto_cipher_setkey(struct crypto_cipher *tfm, static inline void crypto_cipher_encrypt_one(struct crypto_cipher *tfm, u8 *dst, const u8 *src) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return; -#endif - crypto_cipher_crt(tfm)->cit_encrypt_one(crypto_cipher_tfm(tfm), dst, src); } @@ -1160,11 +1097,6 @@ static inline void crypto_cipher_encrypt_one(struct crypto_cipher *tfm, static inline void crypto_cipher_decrypt_one(struct crypto_cipher *tfm, u8 *dst, const u8 *src) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return; -#endif - crypto_cipher_crt(tfm)->cit_decrypt_one(crypto_cipher_tfm(tfm), dst, src); } @@ -1249,11 +1181,6 @@ static inline void crypto_hash_clear_flags(struct crypto_hash *tfm, u32 flags) static inline int crypto_hash_init(struct hash_desc *desc) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_hash_crt(desc->tfm)->init(desc); } @@ -1261,21 +1188,11 @@ static inline int crypto_hash_update(struct hash_desc *desc, struct scatterlist *sg, unsigned int nbytes) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_hash_crt(desc->tfm)->update(desc, sg, nbytes); } static inline int crypto_hash_final(struct hash_desc *desc, u8 *out) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_hash_crt(desc->tfm)->final(desc, out); } @@ -1283,11 +1200,6 @@ static inline int crypto_hash_digest(struct hash_desc *desc, struct scatterlist *sg, unsigned int nbytes, u8 *out) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_hash_crt(desc->tfm)->digest(desc, sg, nbytes, out); } @@ -1352,11 +1264,6 @@ static inline int crypto_comp_compress(struct crypto_comp *tfm, const u8 *src, unsigned int slen, u8 *dst, unsigned int *dlen) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_comp_crt(tfm)->cot_compress(crypto_comp_tfm(tfm), src, slen, dst, dlen); } @@ -1365,13 +1272,9 @@ static inline int crypto_comp_decompress(struct crypto_comp *tfm, const u8 *src, unsigned int slen, u8 *dst, unsigned int *dlen) { -#ifdef CONFIG_CRYPTO_FIPS - if (unlikely(in_fips_err())) - return -EACCES; -#endif - return crypto_comp_crt(tfm)->cot_decompress(crypto_comp_tfm(tfm), src, slen, dst, dlen); } #endif /* _LINUX_CRYPTO_H */ + diff --git a/include/net/bluetooth/hci_mon.h b/include/net/bluetooth/hci_mon.h deleted file mode 120000 index e48f44c..0000000 --- a/include/net/bluetooth/hci_mon.h +++ /dev/null @@ -1 +0,0 @@ -tizen/hci_mon.h
\ No newline at end of file |