^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /* Multipath TCP cryptographic functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * Copyright (c) 2017 - 2019, Intel Corporation.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Note: This code is based on mptcp_ctrl.c, mptcp_ipv4.c, and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * mptcp_ipv6 from multipath-tcp.org, authored by:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Sébastien Barré <sebastien.barre@uclouvain.be>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * Christoph Paasch <christoph.paasch@uclouvain.be>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * Jaakko Korkeaniemi <jaakko.korkeaniemi@aalto.fi>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) * Gregory Detal <gregory.detal@uclouvain.be>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * Fabien Duchêne <fabien.duchene@uclouvain.be>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) * Andreas Seelinger <Andreas.Seelinger@rwth-aachen.de>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) * Lavkesh Lahngir <lavkesh51@gmail.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) * Andreas Ripke <ripke@neclab.eu>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) * Vlad Dogaru <vlad.dogaru@intel.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) * Octavian Purdila <octavian.purdila@intel.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) * John Ronan <jronan@tssg.org>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) * Catalin Nicutar <catalin.nicutar@gmail.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) * Brandon Heller <brandonh@stanford.edu>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #include <crypto/sha.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include <asm/unaligned.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) #include "protocol.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) #define SHA256_DIGEST_WORDS (SHA256_DIGEST_SIZE / 4)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) void mptcp_crypto_key_sha(u64 key, u32 *token, u64 *idsn)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) __be32 mptcp_hashed_key[SHA256_DIGEST_WORDS];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) __be64 input = cpu_to_be64(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) sha256((__force u8 *)&input, sizeof(input), (u8 *)mptcp_hashed_key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) if (token)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) *token = be32_to_cpu(mptcp_hashed_key[0]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) if (idsn)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) *idsn = be64_to_cpu(*((__be64 *)&mptcp_hashed_key[6]));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) void mptcp_crypto_hmac_sha(u64 key1, u64 key2, u8 *msg, int len, void *hmac)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) u8 input[SHA256_BLOCK_SIZE + SHA256_DIGEST_SIZE];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) u8 key1be[8];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) u8 key2be[8];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) if (WARN_ON_ONCE(len > SHA256_DIGEST_SIZE))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) len = SHA256_DIGEST_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) put_unaligned_be64(key1, key1be);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) put_unaligned_be64(key2, key2be);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) /* Generate key xored with ipad */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) memset(input, 0x36, SHA256_BLOCK_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) for (i = 0; i < 8; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) input[i] ^= key1be[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) for (i = 0; i < 8; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) input[i + 8] ^= key2be[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) memcpy(&input[SHA256_BLOCK_SIZE], msg, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) /* emit sha256(K1 || msg) on the second input block, so we can
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) * reuse 'input' for the last hashing
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) sha256(input, SHA256_BLOCK_SIZE + len, &input[SHA256_BLOCK_SIZE]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) /* Prepare second part of hmac */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) memset(input, 0x5C, SHA256_BLOCK_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) for (i = 0; i < 8; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) input[i] ^= key1be[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) for (i = 0; i < 8; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) input[i + 8] ^= key2be[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) sha256(input, SHA256_BLOCK_SIZE + SHA256_DIGEST_SIZE, hmac);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) #if IS_MODULE(CONFIG_MPTCP_KUNIT_TESTS)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) EXPORT_SYMBOL_GPL(mptcp_crypto_hmac_sha);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) #endif