DF-4467 / fix.diff
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 | --- a/sys/crypto/cryptoapi/cryptoapi.c +++ b/sys/crypto/cryptoapi/cryptoapi.c @@ -410,21 +410,23 @@ } static inline void -aes_xts_reinit(struct aes_xts_ctx *ctx, const uint8_t *iv) +aes_xts_reinit(struct aes_xts_ctx *ctx, const uint8_t *iv, uint8_t *tweak) { -#if 0 /* * Prepare tweak as E_k2(IV). IV is specified as LE representation * of a 64-bit block number which we allow to be passed in directly. + * + * The tweak is built in a CALLER-SUPPLIED buffer: the session ctx + * may be shared by concurrent cryptoapi_cipher_crypt() calls (e.g. + * dm_target_crypt bio submission from several CPUs), and the XTS + * tweak mutates per data block, so a ctx->tweak field would race. */ - /* XXX: possibly use htole64? */ -#endif - memcpy(ctx->tweak, iv, AES_XTS_IV_LEN); + memcpy(tweak, iv, AES_XTS_IV_LEN); /* Last 64 bits of IV are always zero */ - bzero(ctx->tweak + AES_XTS_IV_LEN, AES_XTS_IV_LEN); + bzero(tweak + AES_XTS_IV_LEN, AES_XTS_IV_LEN); - rijndael_encrypt(&ctx->key2, ctx->tweak, ctx->tweak); + rijndael_encrypt(&ctx->key2, tweak, tweak); } static void @@ -432,11 +434,12 @@ bool encrypt) { uint8_t block[AES_XTS_BLOCK_LEN]; + uint8_t tweak[AES_XTS_BLOCK_LEN]; struct aes_xts_ctx *ctx = _ctx; - aes_xts_reinit(ctx, iv); + aes_xts_reinit(ctx, iv, tweak); - crypt_data_xts(&ctx->key1, data, datalen, ctx->tweak, + crypt_data_xts(&ctx->key1, data, datalen, tweak, encrypt ? rijndael_encrypt_wrap : rijndael_decrypt_wrap, block, AES_XTS_BLOCK_LEN, AES_XTS_ALPHA); } @@ -729,25 +732,16 @@ }; static inline void -twofish_xts_reinit(struct twofish_xts_ctx *ctx, const uint8_t *iv) +twofish_xts_reinit(struct twofish_xts_ctx *ctx, const uint8_t *iv, + uint8_t *tweak) { -#if 0 - u_int64_t blocknum; -#endif - -#if 0 - /* - * Prepare tweak as E_k2(IV). IV is specified as LE representation - * of a 64-bit block number which we allow to be passed in directly. - */ - /* XXX: possibly use htole64? */ -#endif - memcpy(ctx->tweak, iv, TWOFISH_XTS_IV_LEN); + /* tweak is per-call: see aes_xts_reinit() */ + memcpy(tweak, iv, TWOFISH_XTS_IV_LEN); /* Last 64 bits of IV are always zero */ - bzero(ctx->tweak + TWOFISH_XTS_IV_LEN, TWOFISH_XTS_IV_LEN); + bzero(tweak + TWOFISH_XTS_IV_LEN, TWOFISH_XTS_IV_LEN); - twofish_encrypt(&ctx->key2, ctx->tweak, ctx->tweak); + twofish_encrypt(&ctx->key2, tweak, tweak); } static int @@ -782,11 +776,12 @@ bool encrypt) { uint8_t block[TWOFISH_XTS_BLOCK_LEN]; + uint8_t tweak[TWOFISH_XTS_BLOCK_LEN]; struct twofish_xts_ctx *ctx = _ctx; - twofish_xts_reinit(ctx, iv); + twofish_xts_reinit(ctx, iv, tweak); - crypt_data_xts(&ctx->key1, data, datalen, ctx->tweak, + crypt_data_xts(&ctx->key1, data, datalen, tweak, encrypt ? twofish_encrypt_wrap : twofish_decrypt_wrap, block, TWOFISH_XTS_BLOCK_LEN, AES_XTS_ALPHA); } @@ -892,27 +887,16 @@ }; static inline void -serpent_xts_reinit(struct serpent_xts_ctx *ctx, const uint8_t *iv) +serpent_xts_reinit(struct serpent_xts_ctx *ctx, const uint8_t *iv, + uint8_t *tweak) { -#if 0 - u_int64_t blocknum; - u_int i; -#endif - -#if 0 - /* - * Prepare tweak as E_k2(IV). IV is specified as LE representation - * of a 64-bit block number which we allow to be passed in directly. - */ - /* XXX: possibly use htole64? */ -#endif - - memcpy(ctx->tweak, iv, SERPENT_XTS_IV_LEN); + /* tweak is per-call: see aes_xts_reinit() */ + memcpy(tweak, iv, SERPENT_XTS_IV_LEN); /* Last 64 bits of IV are always zero */ - bzero(ctx->tweak + SERPENT_XTS_IV_LEN, SERPENT_XTS_IV_LEN); + bzero(tweak + SERPENT_XTS_IV_LEN, SERPENT_XTS_IV_LEN); - serpent_encrypt(&ctx->key2, ctx->tweak, ctx->tweak); + serpent_encrypt(&ctx->key2, tweak, tweak); } static int @@ -947,11 +931,12 @@ bool encrypt) { uint8_t block[SERPENT_XTS_BLOCK_LEN]; + uint8_t tweak[SERPENT_XTS_BLOCK_LEN]; struct serpent_xts_ctx *ctx = _ctx; - serpent_xts_reinit(ctx, iv); + serpent_xts_reinit(ctx, iv, tweak); - crypt_data_xts(&ctx->key1, data, datalen, ctx->tweak, + crypt_data_xts(&ctx->key1, data, datalen, tweak, encrypt ? serpent_encrypt_wrap : serpent_decrypt_wrap, block, SERPENT_XTS_BLOCK_LEN, AES_XTS_ALPHA); } |