20240126-LINUXKM_LKCAPI_REGISTER by douzzer · Pull Request #7180 · wolfSSL/wolfssl

douzzer · 2024-01-27T02:02:57Z

linuxkm: completion and stabilization of LKCAPI integration for AES-CBC, AES-CFB, AES-GCM, and AES-XTS:

AES-XTS:
split XtsAes.aes in two, XtsAes.aes_encrypt and XtsAes.aes_decrypt, and add AES_ENCRYPTION_AND_DECRYPTION option constant, to accommodate Linux kernel crypto API model.
in wc_AesXtsSetKeyNoInit(), add FIPS check that main and tweak keys differ, and allow setting encrypt and decrypt keys simultaneously using AES_ENCRYPTION_AND_DECRYPTION.
in wc_AesXtsEncrypt() and wc_AesXtsDecrypt(), error if the required subkey has not been set.

add DEBUG_VECTOR_REGISTER_ACCESS_FUZZING && !DEBUG_VECTOR_REGISTER_ACCESS, with a kernel-compatible implementation of SAVE_VECTOR_REGISTERS2_fuzzer().

squash of philljj's POC work integrating libwolfssl.ko with crypto_register_skcipher/crypto_register_aead, start 2022-12-26, end 2023-01-14.

linuxkm/lkcapi_glue.c:
implement linuxkm_lkcapi_register() and linuxkm_lkcapi_unregister() with idempotency.
add AES-XTS algorithm glue and self-test implementations.
add per-algorithm gating: LINUXKM_LKCAPI_REGISTER_AESCBC, _AESCFB, _AESGCM, and _AESXTS.
carry forward philljj's implementations for AES-CBC, AES-CFB, and AES-GCM, with various cleanups.

linuxkm/module_hooks.c:
print the "wolfCrypt container hashes" message only if DEBUG_LINUXKM_PIE_SUPPORT is set.
render the FIPS version for the self-test success message using the HAVE_FIPS_VERSION* macros.
add a "skipping full wolfcrypt_test() ..." message for --disable-crypttests builds.
add CONFIG_FORTIFY_SOURCE gates.

configure.ac:
add support for --enable-linuxkm-lkcapi-register;
add AES-XTS to output config summary;
rename --enable-xts to --enable-aesxts (retaining old option for backward compatibility).

linuxkm/linuxkm_wc_port.h: add support for CONFIG_FORTIFY_SOURCE.

linuxkm/linuxkm_memory.c:
fix retvals in save_vector_registers_x86() (wc-style MEMORY_E, not sys-style ENOMEM).
add __my_fortify_panic() implementation.

linuxkm/Kbuild: for ENABLED_LINUXKM_PIE in rename-pie-text-and-data-sections recipe, create an .rodata.wolfcrypt section.

linuxkm/include.am: add linuxkm/lkcapi_glue.c to EXTRA_DIST.

wolfcrypt/test/test.c:
when defined(HAVE_FIPS_VERSION), inhibit a test clause in aes_xts_128_test() disallowed by FIPS ("FIPS AES-XTS main and tweak keys must differ").
fix out-of-order user message in ecc_test().

tested with wolfssl-multi-test.sh ... super-quick-check plus a slew (2 dozen) of LKCAPI scenarios with live module loads, including various combinations of AESNI, FIPS, CONFIG_FORTIFY_SOURCE, kernel sanitizers, --enable-crypttests and --disable-crypttests.

…crypto_register_skcipher/crypto_register_aead, start 2022-12-26, end 2023-01-14.

* LKCAPI integration tweaks for buildability and streamlining. * add DEBUG_VECTOR_REGISTER_ACCESS_FUZZING && !DEBUG_VECTOR_REGISTER_ACCESS, with a kernel-compatible implementation of SAVE_VECTOR_REGISTERS2_fuzzer().

split XtsAes.aes in two, XtsAes.aes_encrypt and XtsAes.aes_decrypt, and add AES_ENCRYPTION_AND_DECRYPTION option constant, to accommodate Linux kernel crypto API model. in wc_AesXtsSetKeyNoInit(), add FIPS check that main and tweak keys differ, and allow setting encrypt and decrypt keys simultaneously using AES_ENCRYPTION_AND_DECRYPTION. in wc_AesXtsEncrypt() and wc_AesXtsDecrypt(), error if the required subkey has not been set.

…BC, AES-CFB, AES-GCM, and AES-XTS: linuxkm/lkcapi_glue.c (added in earlier commit): implement linuxkm_lkcapi_register() and linuxkm_lkcapi_unregister() with idempotency. add AES-XTS algorithm glue and self-test implementations. add per-algorithm gating: LINUXKM_LKCAPI_REGISTER_AESCBC, _AESCFB, _AESGCM, and _AESXTS. carry forward philljj's implementations for AES-CBC, AES-CFB, and AES-GCM, with various cleanups. linuxkm/module_hooks.c: print the "wolfCrypt container hashes" message only if DEBUG_LINUXKM_PIE_SUPPORT is set. render the FIPS version for the self-test success message using the HAVE_FIPS_VERSION* macros. add a "skipping full wolfcrypt_test() ..." message for --disable-crypttests builds. add CONFIG_FORTIFY_SOURCE gates. configure.ac: add support for --enable-linuxkm-lkcapi-register; add AES-XTS to output config summary; rename --enable-xts to --enable-aesxts (retaining old option for backward compatibility). linuxkm/linuxkm_wc_port.h: add support for CONFIG_FORTIFY_SOURCE. linuxkm/linuxkm_memory.c: fix retvals in save_vector_registers_x86() (wc-style MEMORY_E, not sys-style ENOMEM). add __my_fortify_panic() implementation. linuxkm/Kbuild: for ENABLED_LINUXKM_PIE in rename-pie-text-and-data-sections recipe, create an .rodata.wolfcrypt section. linuxkm/include.am: add linuxkm/lkcapi_glue.c to EXTRA_DIST. wolfcrypt/test/test.c: when defined(HAVE_FIPS_VERSION), inhibit a test clause in aes_xts_128_test() disallowed by FIPS ("FIPS AES-XTS main and tweak keys must differ"). fix out-of-order user message in ecc_test().

…sXts.aes_decrypt.

…lfssl/wolfcrypt/settings.h.

…emmove() (CONFIG_FORTIFY_SOURCE workarounds) with copy-by-words codepaths.

…ound struct km_AesCtx with separate aes_encrypt and aes_decrypt Aes pointers, and no cached key, to avoid AesSetKey operations at encrypt/decrypt time.

* support AES_ENCRYPTION_AND_DECRYPTION only if WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS is defined, and define it in linuxkm_wc_port.h if LINUXKM_LKCAPI_REGISTER. * fix a typo in km_AesInitCommon(). * remove #if 0 code in lkcapi_glue.c.

douzzer · 2024-01-29T07:19:53Z

retest this please.

dgarske · 2024-01-29T15:41:01Z

    }

-    if ((ret = wc_AesSetKey(&aes->aes, key, keySz, NULL, dir)) == 0) {
+#ifdef HAVE_FIPS_VERSION


Is it better to gate on HAVE_FIPS?

yeah might be. I'll check the codebase and do whatever's consistent.

fixed. defined(HAVE_FIPS) was definitely the right idea.

…armonize error catching, reporting, and error codes; further address peer review feedback.

…heses-equality.

douzzer · 2024-01-30T03:03:03Z

retest this please.

douzzer · 2024-01-30T18:03:05Z

retest this please.

dgarske · 2024-01-30T19:19:50Z

        0x77, 0x8a, 0xe8, 0xb4, 0x3c, 0xb9, 0x8d, 0x5a
    };

+#ifndef HAVE_FIPS_VERSION /* FIPS requires different keys for main and tweak. */


Should it be #ifndef HAVE_FIPS?

fixed. also fixed this in 8 other places.

…FIPS_VERSION).

douzzer · 2024-01-31T02:31:02Z

retest this please.

douzzer · 2024-01-31T04:09:37Z

retest this please....

… "failed:" to error messages in km_AesGcmEncrypt() and km_AesGcmDecrypt().

douzzer · 2024-01-31T19:15:19Z

retest this please...

* configure.ac: in linuxkm-lkcapi-register section, force ENABLED_AESGCM_STREAM=yes if ENABLED_AESGCM is yes and there is asm or FIPS in the picture. * linuxkm/module_hooks.c: in updateFipsHash(), if DEBUG_LINUXKM_PIE_SUPPORT || WOLFSSL_LINUXKM_VERBOSE_DEBUG, print the base16 hash to the kernel log. * linuxkm/lkcapi_glue.c: * implement KATs for AES-CBC, AES-CFB, and AES-GCM. * clean out extraneous code and macro usage inherited from test/test.c. * add post-registration crypto_tfm_alg_driver_name() tests for AES-CBC, AES-CFB, and AES-GCM.

douzzer added 5 commits January 26, 2024 15:22

linuxkm: squash of philljj's POC work integrating libwolfssl.ko with …

6e559ed

…crypto_register_skcipher/crypto_register_aead, start 2022-12-26, end 2023-01-14.

linuxkm:

1f4cf41

* LKCAPI integration tweaks for buildability and streamlining. * add DEBUG_VECTOR_REGISTER_ACCESS_FUZZING && !DEBUG_VECTOR_REGISTER_ACCESS, with a kernel-compatible implementation of SAVE_VECTOR_REGISTERS2_fuzzer().

linuxkm: add linuxkm/lkcapi_glue.c.

ec60f91

douzzer requested a review from wolfSSL-Bot January 27, 2024 02:02

douzzer assigned wolfSSL-Bot Jan 27, 2024

douzzer added 4 commits January 26, 2024 20:19

wolfcrypt/src/port/arm/armv8-aes.c: fix for AesXts.aes_encrypt and Ae…

a0415ce

…sXts.aes_decrypt.

linuxkm: move "#undef HAVE_PTHREAD" from linuxkm/module_hooks.c to wo…

82d94da

…lfssl/wolfcrypt/settings.h.

linuxkm/linuxkm_wc_port.h: improve my_memcpy(), my_memset(), and my_m…

8ae031a

…emmove() (CONFIG_FORTIFY_SOURCE workarounds) with copy-by-words codepaths.

linuxkm/lkcapi_glue.c: refactor AES-CBC, AES-CFB, and AES-GCM glue ar…

957fc74

…ound struct km_AesCtx with separate aes_encrypt and aes_decrypt Aes pointers, and no cached key, to avoid AesSetKey operations at encrypt/decrypt time.

douzzer requested a review from SparkiDev January 28, 2024 17:37

SparkiDev requested changes Jan 28, 2024

View reviewed changes

linuxkm: address peer review:

1fc6718

* support AES_ENCRYPTION_AND_DECRYPTION only if WC_AES_XTS_SUPPORT_SIMULTANEOUS_ENC_AND_DEC_KEYS is defined, and define it in linuxkm_wc_port.h if LINUXKM_LKCAPI_REGISTER. * fix a typo in km_AesInitCommon(). * remove #if 0 code in lkcapi_glue.c.

douzzer force-pushed the 20240126-LINUXKM_LKCAPI_REGISTER branch from ffce1a5 to 1fc6718 Compare January 29, 2024 05:59

wolfcrypt/src/port/arm/armv8-aes.c: revert changes in a0415ce.

856c9a9

dgarske requested changes Jan 29, 2024

View reviewed changes

dgarske requested a review from SparkiDev January 29, 2024 23:00

dgarske assigned douzzer and unassigned wolfSSL-Bot Jan 29, 2024

linuxkm: fix line lengths throughout; in linuxkm/lkcapi_glue.c: fix/h…

6261108

…armonize error catching, reporting, and error codes; further address peer review feedback.

douzzer requested a review from dgarske January 29, 2024 23:52

wolfcrypt/src/aes.c: coddle XCode (clang) to clear frivolous -Wparent…

11e8a89

…heses-equality.

douzzer assigned wolfSSL-Bot and unassigned douzzer Jan 30, 2024

dgarske requested changes Jan 30, 2024

View reviewed changes

dgarske assigned douzzer Jan 30, 2024

AES-XTS: fix FIPS gating to use defined(HAVE_FIPS), not defined(HAVE_…

f228a85

…FIPS_VERSION).

douzzer requested a review from dgarske January 30, 2024 23:18

linuxkm: spruce up arch-dependent CFLAGS setup in linuxkm/Kbuild; add…

e1ee5e4

… "failed:" to error messages in km_AesGcmEncrypt() and km_AesGcmDecrypt().

douzzer mentioned this pull request Jan 31, 2024

Fix arm64 kernel module build #7192

Closed

4 tasks

SparkiDev approved these changes Feb 2, 2024

View reviewed changes

douzzer assigned SparkiDev and unassigned douzzer Feb 2, 2024

SparkiDev removed the request for review from wolfSSL-Bot February 2, 2024 06:36

SparkiDev assigned dgarske and unassigned SparkiDev Feb 2, 2024

dgarske approved these changes Feb 2, 2024

View reviewed changes

dgarske merged commit 32aecf4 into wolfSSL:master Feb 2, 2024

Conversation

douzzer commented Jan 27, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

douzzer commented Jan 29, 2024

Uh oh!

dgarske Jan 29, 2024

Choose a reason for hiding this comment

Uh oh!

douzzer Jan 29, 2024

Choose a reason for hiding this comment

Uh oh!

douzzer Jan 29, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

douzzer commented Jan 30, 2024

Uh oh!

douzzer commented Jan 30, 2024

Uh oh!

dgarske Jan 30, 2024

Choose a reason for hiding this comment

Uh oh!

douzzer Jan 30, 2024

Choose a reason for hiding this comment

Uh oh!

douzzer commented Jan 31, 2024

Uh oh!

douzzer commented Jan 31, 2024 • edited by bandi13 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

douzzer commented Jan 31, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

douzzer commented Jan 31, 2024 •

edited by bandi13

Loading

douzzer commented Jan 31, 2024 •

edited

Loading