luna - wolfssl/linuxkm/lkcapi_rsa

   1/* lkcapi_rsa_glue.c -- glue logic to register RSA wolfCrypt implementations
   2 * with the Linux Kernel Cryptosystem
   3 *
   4 * Copyright (C) 2006-2026 wolfSSL Inc.
   5 *
   6 * This file is part of wolfSSL.
   7 *
   8 * wolfSSL is free software; you can redistribute it and/or modify
   9 * it under the terms of the GNU General Public License as published by
  10 * the Free Software Foundation; either version 3 of the License, or
  11 * (at your option) any later version.
  12 *
  13 * wolfSSL is distributed in the hope that it will be useful,
  14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 * GNU General Public License for more details.
  17 *
  18 * You should have received a copy of the GNU General Public License
  19 * along with this program; if not, write to the Free Software
  20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  21 */
  22
  23/* included by linuxkm/lkcapi_glue.c */
  24#ifndef WC_SKIP_INCLUDED_C_FILES
  25
  26#ifndef LINUXKM_LKCAPI_REGISTER
  27    #error lkcapi_rsa_glue.c included in non-LINUXKM_LKCAPI_REGISTER project.
  28#endif
  29
  30#ifndef RHEL_RELEASE_VERSION
  31    #define RHEL_RELEASE_VERSION(a, b) (((a) << 8) + (b))
  32#endif
  33
  34#if !defined(NO_RSA)
  35    #if (defined(LINUXKM_LKCAPI_REGISTER_ALL) || \
  36         (defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) && defined(CONFIG_CRYPTO_RSA))) && \
  37        !defined(LINUXKM_LKCAPI_DONT_REGISTER_RSA) &&                  \
  38        !defined(LINUXKM_LKCAPI_REGISTER_RSA)
  39        #define LINUXKM_LKCAPI_REGISTER_RSA
  40    #endif
  41#else
  42    #undef LINUXKM_LKCAPI_REGISTER_RSA
  43#endif /* !NO_RSA */
  44
  45#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0)
  46    /*
  47     * note: In linux 6.13 the sign/verify callbacks were removed from
  48     * akcipher_alg, and ecdsa changed from a struct akcipher_alg type to
  49     * struct sig_alg type. The struct sig_alg was used for sign verify
  50     * going forward.
  51     *
  52     *  - "pkcs1pad(rsa)" remained a struct akcipher_alg, but without
  53     *    sign/verify functionality, and without hash encoding.
  54     *
  55     *  - "pkcs1(rsa, <hash>)" was introduced as a struct sig_alg with sign,
  56     *    verify functionality.
  57     *
  58     *  - "rsa" (direct rsa, no padding) is the same before and after 6.13.
  59     *
  60     * wolfssl linuxkm supports direct rsa "rsa", akcipher rsa "pkcs1pad",
  61     * and sig_alg rsa "pkcs1".
  62     */
  63    #if defined (LINUXKM_LKCAPI_REGISTER_RSA)
  64        #define LINUXKM_AKCIPHER_NO_SIGNVERIFY
  65    #endif /* LINUXKM_LKCAPI_REGISTER_RSA */
  66#endif /* linux >= 6.13.0 */
  67
  68#if defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) && \
  69    defined(CONFIG_CRYPTO_RSA) && \
  70    !defined(LINUXKM_LKCAPI_REGISTER_RSA) && \
  71    !defined(LINUXKM_LKCAPI_DONT_REGISTER_RSA)
  72    #error Config conflict: target kernel has CONFIG_CRYPTO_RSA, but module is missing LINUXKM_LKCAPI_REGISTER_RSA.
  73#endif
  74
  75#ifdef LINUXKM_LKCAPI_REGISTER_RSA
  76
  77#if defined(WOLFSSL_RSA_VERIFY_ONLY) || \
  78    defined(WOLFSSL_RSA_PUBLIC_ONLY)
  79    #error LINUXKM_LKCAPI_REGISTER_RSA with RSA_VERIFY_ONLY/WOLFSSL_RSA_PUBLIC_ONLY not supported
  80#endif /* WOLFSSL_RSA_VERIFY_ONLY || WOLFSSL_RSA_PUBLIC_ONLY */
  81
  82#ifdef WC_RSA_NO_PADDING
  83    #define LINUXKM_DIRECT_RSA
  84#endif /* WC_RSA_NO_PADDING */
  85
  86/* The pkcs1(<rsa>, <hash>) sign/verify driver was renamed from "pkcs1pad" to
  87 * just "pkcs1" in 6.13.
  88 *
  89 * The original "pkcs1pad" akcipher remained, but without hash algs, and
  90 * without sign/verify callbacks.
  91 * */
  92#if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
  93    #define PKCS1_NAME "pkcs1pad"
  94#else
  95    #define PKCS1_NAME "pkcs1"
  96#endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
  97
  98#include <wolfssl/wolfcrypt/asn.h>
  99#include <wolfssl/wolfcrypt/rsa.h>
 100
 101#define WOLFKM_RSA_NAME      ("rsa")
 102#define WOLFKM_RSA_DRIVER    ("rsa" WOLFKM_DRIVER_FIPS "-wolfcrypt")
 103
 104#if defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
 105    /* the akcipher alg */
 106    #define WOLFKM_PKCS1PAD_NAME   ("pkcs1pad(rsa)")
 107    #define WOLFKM_PKCS1PAD_DRIVER ("pkcs1pad(rsa" WOLFKM_DRIVER_FIPS \
 108                                        "-wolfcrypt)")
 109#endif /* LINUXKM_AKCIPHER_NO_SIGNVERIFY */
 110
 111/*
 112 * pkcs1 sign verify alg names
 113 * */
 114#define WOLFKM_PKCS1_SHA224_NAME   (PKCS1_NAME "(rsa,sha224)")
 115#define WOLFKM_PKCS1_SHA224_DRIVER (PKCS1_NAME "(rsa" WOLFKM_DRIVER_FIPS \
 116                                    "-wolfcrypt,sha224)")
 117
 118#define WOLFKM_PKCS1_SHA256_NAME   (PKCS1_NAME "(rsa,sha256)")
 119#define WOLFKM_PKCS1_SHA256_DRIVER (PKCS1_NAME "(rsa" WOLFKM_DRIVER_FIPS \
 120                                    "-wolfcrypt,sha256)")
 121
 122#define WOLFKM_PKCS1_SHA384_NAME   (PKCS1_NAME "(rsa,sha384)")
 123#define WOLFKM_PKCS1_SHA384_DRIVER (PKCS1_NAME "(rsa" WOLFKM_DRIVER_FIPS \
 124                                    "-wolfcrypt,sha384)")
 125
 126#define WOLFKM_PKCS1_SHA512_NAME   (PKCS1_NAME "(rsa,sha512)")
 127#define WOLFKM_PKCS1_SHA512_DRIVER (PKCS1_NAME "(rsa" WOLFKM_DRIVER_FIPS \
 128                                    "-wolfcrypt,sha512)")
 129
 130#define WOLFKM_PKCS1_SHA3_256_NAME   (PKCS1_NAME "(rsa,sha3-256)")
 131#define WOLFKM_PKCS1_SHA3_256_DRIVER (PKCS1_NAME "(rsa" WOLFKM_DRIVER_FIPS \
 132                                      "-wolfcrypt,sha3-256)")
 133
 134#define WOLFKM_PKCS1_SHA3_384_NAME   (PKCS1_NAME "(rsa,sha3-384)")
 135#define WOLFKM_PKCS1_SHA3_384_DRIVER (PKCS1_NAME "(rsa" WOLFKM_DRIVER_FIPS \
 136                                      "-wolfcrypt,sha3-384)")
 137
 138#define WOLFKM_PKCS1_SHA3_512_NAME   (PKCS1_NAME "(rsa,sha3-512)")
 139#define WOLFKM_PKCS1_SHA3_512_DRIVER (PKCS1_NAME "(rsa" WOLFKM_DRIVER_FIPS \
 140                                      "-wolfcrypt,sha3-512)")
 141
 142#if defined(WOLFSSL_KEY_GEN)
 143    #if defined(LINUXKM_DIRECT_RSA)
 144        static int  linuxkm_test_rsa_driver(const char * driver, int nbits);
 145    #endif /* LINUXKM_DIRECT_RSA */
 146    static int  linuxkm_test_pkcs1pad_driver(const char * driver, int nbits,
 147                                             int hash_oid, word32 hash_len,
 148                                             uint8_t optional);
 149
 150    #if defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
 151    static int  linuxkm_test_pkcs1_driver(const char * driver, int nbits,
 152                                          int hash_oid, word32 hash_len,
 153                                          uint8_t optional);
 154    #endif /* LINUXKM_AKCIPHER_NO_SIGNVERIFY */
 155#endif /* WOLFSSL_KEY_GEN */
 156
 157#if defined(LINUXKM_DIRECT_RSA)
 158    static int direct_rsa_loaded = 0;
 159#endif /* LINUXKM_DIRECT_RSA */
 160#if defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
 161    static int pkcs1pad_loaded = 0;
 162#endif /* LINUXKM_AKCIPHER_NO_SIGNVERIFY */
 163#ifdef WOLFSSL_SHA224
 164    static int pkcs1_sha224_loaded = 0;
 165#endif /* WOLFSSL_SHA224 */
 166#ifndef NO_SHA256
 167    static int pkcs1_sha256_loaded = 0;
 168#endif /* !NO_SHA256 */
 169#ifdef WOLFSSL_SHA384
 170    static int pkcs1_sha384_loaded = 0;
 171#endif /* WOLFSSL_SHA384 */
 172#ifdef WOLFSSL_SHA512
 173    static int pkcs1_sha512_loaded = 0;
 174#endif /* WOLFSSL_SHA512 */
 175#ifdef WOLFSSL_SHA3
 176    static int pkcs1_sha3_256_loaded = 0;
 177    static int pkcs1_sha3_384_loaded = 0;
 178    static int pkcs1_sha3_512_loaded = 0;
 179#endif /* WOLFSSL_SHA3 */
 180
 181struct km_rsa_ctx {
 182    WC_RNG       rng;            /* needed for pkcs1 padding, and blinding */
 183    RsaKey *     key;
 184    int          hash_oid;       /* hash_oid for wc_EncodeSignature */
 185    unsigned int digest_len;
 186    word32       key_len;
 187};
 188
 189/* shared rsa callbacks */
 190static int          km_rsa_ctx_init(struct km_rsa_ctx * ctx, int hash_oid);
 191static void         km_rsa_exit(struct crypto_akcipher *tfm);
 192static int          km_rsa_set_priv(struct crypto_akcipher *tfm,
 193                                    const void *key, unsigned int keylen);
 194static int          km_rsa_set_pub(struct crypto_akcipher *tfm,
 195                                   const void *key, unsigned int keylen);
 196static unsigned int km_rsa_max_size(struct crypto_akcipher *tfm);
 197
 198#if defined(LINUXKM_DIRECT_RSA)
 199    /* direct rsa callbacks */
 200    static int          km_direct_rsa_init(struct crypto_akcipher *tfm);
 201    static int          km_direct_rsa_enc(struct akcipher_request *req);
 202    static int          km_direct_rsa_dec(struct akcipher_request *req);
 203#endif /* LINUXKM_DIRECT_RSA */
 204
 205#if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
 206    #define tfm_type   crypto_akcipher
 207    #define tfm_ctx_cb akcipher_tfm_ctx
 208#else
 209    #define tfm_type   crypto_sig
 210    #define tfm_ctx_cb crypto_sig_ctx
 211
 212    static int          km_pkcs1pad_init(struct crypto_akcipher * tfm);
 213#endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
 214
 215/* pkcs1 callbacks */
 216#ifdef WOLFSSL_SHA224
 217    static int          km_pkcs1_sha224_init(struct tfm_type *tfm);
 218#endif /* WOLFSSL_SHA224 */
 219#ifndef NO_SHA256
 220    static int          km_pkcs1_sha256_init(struct tfm_type *tfm);
 221#endif /* !NO_SHA256 */
 222#ifdef WOLFSSL_SHA384
 223    static int          km_pkcs1_sha384_init(struct tfm_type *tfm);
 224#endif /* WOLFSSL_SHA384 */
 225#ifdef WOLFSSL_SHA512
 226    static int          km_pkcs1_sha512_init(struct tfm_type *tfm);
 227#endif /* WOLFSSL_SHA512 */
 228#ifdef WOLFSSL_SHA3
 229    static int          km_pkcs1_sha3_256_init(struct tfm_type *tfm);
 230    static int          km_pkcs1_sha3_384_init(struct tfm_type *tfm);
 231    static int          km_pkcs1_sha3_512_init(struct tfm_type *tfm);
 232#endif /* WOLFSSL_SHA3 */
 233
 234    /* akcipher callbacks */
 235    static int          km_pkcs1pad_enc(struct akcipher_request *req);
 236    static int          km_pkcs1pad_dec(struct akcipher_request *req);
 237#if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
 238    static int          km_pkcs1pad_sign(struct akcipher_request *req);
 239    static int          km_pkcs1pad_verify(struct akcipher_request *req);
 240#else
 241    /* sig_alg callbacks */
 242    static int          km_pkcs1_set_priv(struct crypto_sig *tfm,
 243                                          const void *key,
 244                                          unsigned int keylen);
 245    static int          km_pkcs1_set_pub(struct crypto_sig *tfm,
 246                                         const void *key,
 247                                         unsigned int keylen);
 248    static unsigned int km_pkcs1_key_size(struct crypto_sig *tfm);
 249    static int          km_pkcs1_sign(struct crypto_sig *tfm,
 250                                      const void *src, unsigned int slen,
 251                                      void *dst, unsigned int dlen);
 252    static int          km_pkcs1_verify(struct crypto_sig *tfm,
 253                                        const void *src, unsigned int slen,
 254                                        const void *digest, unsigned int dlen);
 255    static void         km_pkcs1_exit(struct crypto_sig *tfm);
 256#endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
 257/* misc */
 258    static int          get_hash_enc_len(int hash_oid);
 259
 260#if defined(LINUXKM_DIRECT_RSA)
 261static struct akcipher_alg direct_rsa = {
 262    .base.cra_name        = WOLFKM_RSA_NAME,
 263    .base.cra_driver_name = WOLFKM_RSA_DRIVER,
 264    .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 265    .base.cra_module      = THIS_MODULE,
 266    .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 267    .encrypt              = km_direct_rsa_enc,
 268    .decrypt              = km_direct_rsa_dec,
 269    .set_priv_key         = km_rsa_set_priv,
 270    .set_pub_key          = km_rsa_set_pub,
 271    .max_size             = km_rsa_max_size,
 272    .init                 = km_direct_rsa_init,
 273    .exit                 = km_rsa_exit,
 274};
 275#endif /* LINUXKM_DIRECT_RSA */
 276
 277#if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
 278    #ifdef WOLFSSL_SHA224
 279    static struct akcipher_alg pkcs1_sha224 = {
 280        .base.cra_name        = WOLFKM_PKCS1_SHA224_NAME,
 281        .base.cra_driver_name = WOLFKM_PKCS1_SHA224_DRIVER,
 282        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 283        .base.cra_module      = THIS_MODULE,
 284        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 285        .sign                 = km_pkcs1pad_sign,
 286        .verify               = km_pkcs1pad_verify,
 287        .encrypt              = km_pkcs1pad_enc,
 288        .decrypt              = km_pkcs1pad_dec,
 289        .set_priv_key         = km_rsa_set_priv,
 290        .set_pub_key          = km_rsa_set_pub,
 291        .max_size             = km_rsa_max_size,
 292        .init                 = km_pkcs1_sha224_init,
 293        .exit                 = km_rsa_exit,
 294    };
 295    #endif /* WOLFSSL_SHA224 */
 296
 297    #ifndef NO_SHA256
 298    static struct akcipher_alg pkcs1_sha256 = {
 299        .base.cra_name        = WOLFKM_PKCS1_SHA256_NAME,
 300        .base.cra_driver_name = WOLFKM_PKCS1_SHA256_DRIVER,
 301        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 302        .base.cra_module      = THIS_MODULE,
 303        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 304        .sign                 = km_pkcs1pad_sign,
 305        .verify               = km_pkcs1pad_verify,
 306        .encrypt              = km_pkcs1pad_enc,
 307        .decrypt              = km_pkcs1pad_dec,
 308        .set_priv_key         = km_rsa_set_priv,
 309        .set_pub_key          = km_rsa_set_pub,
 310        .max_size             = km_rsa_max_size,
 311        .init                 = km_pkcs1_sha256_init,
 312        .exit                 = km_rsa_exit,
 313    };
 314    #endif /* !NO_SHA256 */
 315
 316    #ifdef WOLFSSL_SHA384
 317    static struct akcipher_alg pkcs1_sha384 = {
 318        .base.cra_name        = WOLFKM_PKCS1_SHA384_NAME,
 319        .base.cra_driver_name = WOLFKM_PKCS1_SHA384_DRIVER,
 320        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 321        .base.cra_module      = THIS_MODULE,
 322        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 323        .sign                 = km_pkcs1pad_sign,
 324        .verify               = km_pkcs1pad_verify,
 325        .encrypt              = km_pkcs1pad_enc,
 326        .decrypt              = km_pkcs1pad_dec,
 327        .set_priv_key         = km_rsa_set_priv,
 328        .set_pub_key          = km_rsa_set_pub,
 329        .max_size             = km_rsa_max_size,
 330        .init                 = km_pkcs1_sha384_init,
 331        .exit                 = km_rsa_exit,
 332    };
 333    #endif /* WOLFSSL_SHA384 */
 334
 335    #ifdef WOLFSSL_SHA512
 336    static struct akcipher_alg pkcs1_sha512 = {
 337        .base.cra_name        = WOLFKM_PKCS1_SHA512_NAME,
 338        .base.cra_driver_name = WOLFKM_PKCS1_SHA512_DRIVER,
 339        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 340        .base.cra_module      = THIS_MODULE,
 341        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 342        .sign                 = km_pkcs1pad_sign,
 343        .verify               = km_pkcs1pad_verify,
 344        .encrypt              = km_pkcs1pad_enc,
 345        .decrypt              = km_pkcs1pad_dec,
 346        .set_priv_key         = km_rsa_set_priv,
 347        .set_pub_key          = km_rsa_set_pub,
 348        .max_size             = km_rsa_max_size,
 349        .init                 = km_pkcs1_sha512_init,
 350        .exit                 = km_rsa_exit,
 351    };
 352    #endif /* WOLFSSL_SHA512 */
 353
 354    #ifdef WOLFSSL_SHA3
 355    static struct akcipher_alg pkcs1_sha3_256 = {
 356        .base.cra_name        = WOLFKM_PKCS1_SHA3_256_NAME,
 357        .base.cra_driver_name = WOLFKM_PKCS1_SHA3_256_DRIVER,
 358        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 359        .base.cra_module      = THIS_MODULE,
 360        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 361        .sign                 = km_pkcs1pad_sign,
 362        .verify               = km_pkcs1pad_verify,
 363        .encrypt              = km_pkcs1pad_enc,
 364        .decrypt              = km_pkcs1pad_dec,
 365        .set_priv_key         = km_rsa_set_priv,
 366        .set_pub_key          = km_rsa_set_pub,
 367        .max_size             = km_rsa_max_size,
 368        .init                 = km_pkcs1_sha3_256_init,
 369        .exit                 = km_rsa_exit,
 370    };
 371
 372    static struct akcipher_alg pkcs1_sha3_384 = {
 373        .base.cra_name        = WOLFKM_PKCS1_SHA3_384_NAME,
 374        .base.cra_driver_name = WOLFKM_PKCS1_SHA3_384_DRIVER,
 375        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 376        .base.cra_module      = THIS_MODULE,
 377        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 378        .sign                 = km_pkcs1pad_sign,
 379        .verify               = km_pkcs1pad_verify,
 380        .encrypt              = km_pkcs1pad_enc,
 381        .decrypt              = km_pkcs1pad_dec,
 382        .set_priv_key         = km_rsa_set_priv,
 383        .set_pub_key          = km_rsa_set_pub,
 384        .max_size             = km_rsa_max_size,
 385        .init                 = km_pkcs1_sha3_384_init,
 386        .exit                 = km_rsa_exit,
 387    };
 388
 389    static struct akcipher_alg pkcs1_sha3_512 = {
 390        .base.cra_name        = WOLFKM_PKCS1_SHA3_512_NAME,
 391        .base.cra_driver_name = WOLFKM_PKCS1_SHA3_512_DRIVER,
 392        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 393        .base.cra_module      = THIS_MODULE,
 394        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 395        .sign                 = km_pkcs1pad_sign,
 396        .verify               = km_pkcs1pad_verify,
 397        .encrypt              = km_pkcs1pad_enc,
 398        .decrypt              = km_pkcs1pad_dec,
 399        .set_priv_key         = km_rsa_set_priv,
 400        .set_pub_key          = km_rsa_set_pub,
 401        .max_size             = km_rsa_max_size,
 402        .init                 = km_pkcs1_sha3_512_init,
 403        .exit                 = km_rsa_exit,
 404    };
 405    #endif /* WOLFSSL_SHA3 */
 406#else
 407    /* linux kernel >= 6.13 implementation */
 408    static struct akcipher_alg pkcs1pad = {
 409        .base.cra_name        = WOLFKM_PKCS1PAD_NAME,
 410        .base.cra_driver_name = WOLFKM_PKCS1PAD_DRIVER,
 411        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 412        .base.cra_module      = THIS_MODULE,
 413        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 414        .encrypt              = km_pkcs1pad_enc,
 415        .decrypt              = km_pkcs1pad_dec,
 416        .set_priv_key         = km_rsa_set_priv,
 417        .set_pub_key          = km_rsa_set_pub,
 418        .max_size             = km_rsa_max_size,
 419        .init                 = km_pkcs1pad_init,
 420        .exit                 = km_rsa_exit,
 421    };
 422
 423    #ifdef WOLFSSL_SHA224
 424    static struct sig_alg pkcs1_sha224 = {
 425        .base.cra_name        = WOLFKM_PKCS1_SHA224_NAME,
 426        .base.cra_driver_name = WOLFKM_PKCS1_SHA224_DRIVER,
 427        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 428        .base.cra_module      = THIS_MODULE,
 429        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 430        .sign                 = km_pkcs1_sign,
 431        .verify               = km_pkcs1_verify,
 432        .set_priv_key         = km_pkcs1_set_priv,
 433        .set_pub_key          = km_pkcs1_set_pub,
 434        .key_size             = km_pkcs1_key_size,
 435        .init                 = km_pkcs1_sha224_init,
 436        .exit                 = km_pkcs1_exit,
 437    };
 438    #endif /* WOLFSSL_SHA224 */
 439
 440    #ifndef NO_SHA256
 441    static struct sig_alg pkcs1_sha256 = {
 442        .base.cra_name        = WOLFKM_PKCS1_SHA256_NAME,
 443        .base.cra_driver_name = WOLFKM_PKCS1_SHA256_DRIVER,
 444        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 445        .base.cra_module      = THIS_MODULE,
 446        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 447        .sign                 = km_pkcs1_sign,
 448        .verify               = km_pkcs1_verify,
 449        .set_priv_key         = km_pkcs1_set_priv,
 450        .set_pub_key          = km_pkcs1_set_pub,
 451        .key_size             = km_pkcs1_key_size,
 452        .init                 = km_pkcs1_sha256_init,
 453        .exit                 = km_pkcs1_exit,
 454    };
 455    #endif /* !NO_SHA256 */
 456
 457    #ifdef WOLFSSL_SHA384
 458    static struct sig_alg pkcs1_sha384 = {
 459        .base.cra_name        = WOLFKM_PKCS1_SHA384_NAME,
 460        .base.cra_driver_name = WOLFKM_PKCS1_SHA384_DRIVER,
 461        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 462        .base.cra_module      = THIS_MODULE,
 463        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 464        .sign                 = km_pkcs1_sign,
 465        .verify               = km_pkcs1_verify,
 466        .set_priv_key         = km_pkcs1_set_priv,
 467        .set_pub_key          = km_pkcs1_set_pub,
 468        .key_size             = km_pkcs1_key_size,
 469        .init                 = km_pkcs1_sha384_init,
 470        .exit                 = km_pkcs1_exit,
 471    };
 472    #endif /* WOLFSSL_SHA384 */
 473
 474    #ifdef WOLFSSL_SHA512
 475    static struct sig_alg pkcs1_sha512 = {
 476        .base.cra_name        = WOLFKM_PKCS1_SHA512_NAME,
 477        .base.cra_driver_name = WOLFKM_PKCS1_SHA512_DRIVER,
 478        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 479        .base.cra_module      = THIS_MODULE,
 480        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 481        .sign                 = km_pkcs1_sign,
 482        .verify               = km_pkcs1_verify,
 483        .set_priv_key         = km_pkcs1_set_priv,
 484        .set_pub_key          = km_pkcs1_set_pub,
 485        .key_size             = km_pkcs1_key_size,
 486        .init                 = km_pkcs1_sha512_init,
 487        .exit                 = km_pkcs1_exit,
 488    };
 489    #endif /* WOLFSSL_SHA512 */
 490
 491    #ifdef WOLFSSL_SHA3
 492    static struct sig_alg pkcs1_sha3_256 = {
 493        .base.cra_name        = WOLFKM_PKCS1_SHA3_256_NAME,
 494        .base.cra_driver_name = WOLFKM_PKCS1_SHA3_256_DRIVER,
 495        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 496        .base.cra_module      = THIS_MODULE,
 497        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 498        .sign                 = km_pkcs1_sign,
 499        .verify               = km_pkcs1_verify,
 500        .set_priv_key         = km_pkcs1_set_priv,
 501        .set_pub_key          = km_pkcs1_set_pub,
 502        .key_size             = km_pkcs1_key_size,
 503        .init                 = km_pkcs1_sha3_256_init,
 504        .exit                 = km_pkcs1_exit,
 505    };
 506
 507    static struct sig_alg pkcs1_sha3_384 = {
 508        .base.cra_name        = WOLFKM_PKCS1_SHA3_384_NAME,
 509        .base.cra_driver_name = WOLFKM_PKCS1_SHA3_384_DRIVER,
 510        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 511        .base.cra_module      = THIS_MODULE,
 512        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 513        .sign                 = km_pkcs1_sign,
 514        .verify               = km_pkcs1_verify,
 515        .set_priv_key         = km_pkcs1_set_priv,
 516        .set_pub_key          = km_pkcs1_set_pub,
 517        .key_size             = km_pkcs1_key_size,
 518        .init                 = km_pkcs1_sha3_384_init,
 519        .exit                 = km_pkcs1_exit,
 520    };
 521
 522    static struct sig_alg pkcs1_sha3_512 = {
 523        .base.cra_name        = WOLFKM_PKCS1_SHA3_512_NAME,
 524        .base.cra_driver_name = WOLFKM_PKCS1_SHA3_512_DRIVER,
 525        .base.cra_priority    = WOLFSSL_LINUXKM_LKCAPI_PRIORITY,
 526        .base.cra_module      = THIS_MODULE,
 527        .base.cra_ctxsize     = sizeof(struct km_rsa_ctx),
 528        .sign                 = km_pkcs1_sign,
 529        .verify               = km_pkcs1_verify,
 530        .set_priv_key         = km_pkcs1_set_priv,
 531        .set_pub_key          = km_pkcs1_set_pub,
 532        .key_size             = km_pkcs1_key_size,
 533        .init                 = km_pkcs1_sha3_512_init,
 534        .exit                 = km_pkcs1_exit,
 535    };
 536    #endif /* WOLFSSL_SHA3 */
 537#endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
 538
 539static inline void km_rsa_ctx_clear(struct km_rsa_ctx * ctx)
 540{
 541    if (ctx) {
 542        if (ctx->key) {
 543            wc_FreeRsaKey(ctx->key);
 544            free(ctx->key);
 545            ctx->key = NULL;
 546        }
 547
 548        wc_FreeRng(&ctx->rng);
 549    }
 550}
 551
 552static int km_rsa_ctx_init(struct km_rsa_ctx * ctx, int hash_oid)
 553{
 554    int ret = 0;
 555
 556    memset(ctx, 0, sizeof(struct km_rsa_ctx));
 557
 558    ctx->key = (RsaKey *)malloc(sizeof(RsaKey));
 559    if (!ctx->key) {
 560        ret = -ENOMEM;
 561        goto out;
 562    }
 563
 564    ret = wc_InitRsaKey(ctx->key, NULL);
 565    if (ret) {
 566        pr_err("%s: init rsa key returned: %d\n", WOLFKM_RSA_DRIVER, ret);
 567        ret = -EINVAL;
 568        goto out;
 569    }
 570
 571    /* Note the initialization of ctx->rng is deferred unless/until needed. */
 572    ret = wc_RsaSetRNG(ctx->key, &ctx->rng);
 573    if (ret) {
 574        ret = -EINVAL;
 575        goto out;
 576    }
 577
 578    ctx->hash_oid = hash_oid;
 579
 580    switch (ctx->hash_oid) {
 581    case 0:
 582        ctx->digest_len = 0;
 583        break;
 584    #ifdef WOLFSSL_SHA224
 585    case SHA224h:
 586        ctx->digest_len = WC_SHA224_DIGEST_SIZE;
 587        break;
 588    #endif /* WOLFSSL_SHA224 */
 589    #ifndef NO_SHA256
 590    case SHA256h:
 591        ctx->digest_len = WC_SHA256_DIGEST_SIZE;
 592        break;
 593    #endif /* !NO_SHA256 */
 594    #ifdef WOLFSSL_SHA384
 595    case SHA384h:
 596        ctx->digest_len = WC_SHA384_DIGEST_SIZE;
 597        break;
 598    #endif /* WOLFSSL_SHA384 */
 599    #ifdef WOLFSSL_SHA512
 600    case SHA512h:
 601        ctx->digest_len = WC_SHA512_DIGEST_SIZE;
 602        break;
 603    #endif /* WOLFSSL_SHA512 */
 604    #ifdef WOLFSSL_SHA3
 605    case SHA3_256h:
 606        ctx->digest_len = WC_SHA3_256_DIGEST_SIZE;
 607        break;
 608    case SHA3_384h:
 609        ctx->digest_len = WC_SHA3_384_DIGEST_SIZE;
 610        break;
 611    case SHA3_512h:
 612        ctx->digest_len = WC_SHA3_512_DIGEST_SIZE;
 613        break;
 614    #endif /* WOLFSSL_SHA3 */
 615    default:
 616        pr_err("%s: init: unhandled hash_oid: %d\n", WOLFKM_RSA_DRIVER,
 617               hash_oid);
 618        ret = -EINVAL;
 619        goto out;
 620    }
 621
 622    #ifdef WOLFKM_DEBUG_RSA
 623    pr_info("info: exiting km_rsa_ctx_init: hash_oid %d\n", ctx->hash_oid);
 624    #endif /* WOLFKM_DEBUG_RSA */
 625
 626out:
 627    if (ret != 0) {
 628        km_rsa_ctx_clear(ctx);
 629    }
 630
 631    return ret;
 632}
 633
 634static inline int km_rsa_ctx_init_rng(struct km_rsa_ctx * ctx) {
 635    switch (ctx->rng.status) {
 636    case WC_DRBG_OK:
 637#ifdef WC_RNG_BANK_SUPPORT
 638    case WC_DRBG_BANKREF:
 639#endif
 640        return 0;
 641    case WC_DRBG_NOT_INIT:
 642    {
 643        int err = LKCAPI_INITRNG(&ctx->rng);
 644        if (err) {
 645            pr_err("%s: init rng returned: %d\n", WOLFKM_RSA_DRIVER, err);
 646            if (err == WC_NO_ERR_TRACE(MEMORY_E))
 647                return -ENOMEM;
 648            else
 649                return -EINVAL;
 650        }
 651        return 0;
 652    }
 653    default:
 654        return -EINVAL;
 655    }
 656}
 657
 658#if defined(LINUXKM_DIRECT_RSA)
 659/*
 660 * RSA encrypt with public key.
 661 *
 662 * Requires that crypto_akcipher_set_pub_key has been called first.
 663 *
 664 * note: this matches behavior of kernel rsa-generic akcipher, which does
 665 * direct RSA without padding, and without requiring src_len matches RSA
 666 * key size.
 667 *
 668 * returns 0   on success
 669 * returns < 0 on error
 670 */
 671static int km_direct_rsa_enc(struct akcipher_request *req)
 672{
 673    struct crypto_akcipher * tfm = NULL;
 674    struct km_rsa_ctx *      ctx = NULL;
 675    int                      err = 0;
 676    word32                   out_len = 0;
 677    byte *                   dec = NULL;
 678    byte *                   enc = NULL;
 679
 680    if (req->src == NULL || req->dst == NULL) {
 681        err = -EINVAL;
 682        goto rsa_enc_out;
 683    }
 684
 685    tfm = crypto_akcipher_reqtfm(req);
 686    ctx = akcipher_tfm_ctx(tfm);
 687
 688    if (unlikely(ctx->key_len <= 0)) {
 689        err = -EINVAL;
 690        goto rsa_enc_out;
 691    }
 692
 693    out_len = ctx->key_len;
 694
 695    if (req->src_len > (unsigned int) ctx->key_len) {
 696        err = -EOVERFLOW;
 697        goto rsa_enc_out;
 698    }
 699
 700    if (req->dst_len < (unsigned int) ctx->key_len) {
 701        req->dst_len = ctx->key_len;
 702        err = -EOVERFLOW;
 703        goto rsa_enc_out;
 704    }
 705
 706    dec = malloc(req->src_len);
 707    if (unlikely(dec == NULL)) {
 708        err = -ENOMEM;
 709        goto rsa_enc_out;
 710    }
 711
 712    enc = malloc(req->dst_len);
 713    if (unlikely(enc == NULL)) {
 714        err = -ENOMEM;
 715        goto rsa_enc_out;
 716    }
 717
 718    /* copy req->src to dec */
 719    memset(dec, 0, req->src_len);
 720    memset(enc, 0, req->dst_len);
 721    scatterwalk_map_and_copy(dec, req->src, 0, req->src_len, 0);
 722
 723    /* note: matching behavior of kernel rsa-generic. */
 724
 725    /* note, currently WOLF_CRYPTO_CB is not supported for linuxkm, and the rng
 726     * are to wc_RsaFunction() is not actually used for low level (no-pad)
 727     * public key ops in the native implementation (it is a pure function of its
 728     * input args).
 729     */
 730
 731    err = wc_RsaFunction(dec, req->src_len, enc, &out_len,
 732                         RSA_PUBLIC_ENCRYPT, ctx->key, NULL /* rng */);
 733
 734    if (unlikely(err || (out_len != ctx->key_len))) {
 735        #ifdef WOLFKM_DEBUG_RSA
 736        pr_err("error: %s: direct rsa pub enc returned: %d, %d, %d\n",
 737               WOLFKM_RSA_DRIVER, err, out_len, ctx->key_len);
 738        #endif /* WOLFKM_DEBUG_RSA */
 739        err = -EINVAL;
 740        goto rsa_enc_out;
 741    }
 742
 743    /* enc to req->dst */
 744    scatterwalk_map_and_copy(enc, req->dst, 0, ctx->key_len, 1);
 745
 746    err = 0;
 747rsa_enc_out:
 748    if (enc != NULL) { free(enc); enc = NULL; }
 749    if (dec != NULL) { free(dec); dec = NULL; }
 750
 751    #ifdef WOLFKM_DEBUG_RSA
 752    pr_info("info: exiting km_direct_rsa_enc\n");
 753    #endif /* WOLFKM_DEBUG_RSA */
 754    return err;
 755}
 756
 757/*
 758 * RSA decrypt with private key.
 759 *
 760 * Requires that crypto_akcipher_set_priv_key has been called first.
 761 *
 762 * returns 0   on success
 763 * returns < 0 on error
 764 */
 765static int km_direct_rsa_dec(struct akcipher_request *req)
 766{
 767    struct crypto_akcipher * tfm = NULL;
 768    struct km_rsa_ctx *      ctx = NULL;
 769    int                      err = 0;
 770    word32                   out_len = 0;
 771    byte *                   enc = NULL;
 772    byte *                   dec = NULL;
 773
 774    if (req->src == NULL || req->dst == NULL) {
 775        err = -EINVAL;
 776        goto rsa_dec_out;
 777    }
 778
 779    tfm = crypto_akcipher_reqtfm(req);
 780    ctx = akcipher_tfm_ctx(tfm);
 781
 782    if (unlikely(ctx->key_len <= 0)) {
 783        err = -EINVAL;
 784        goto rsa_dec_out;
 785    }
 786
 787    out_len = ctx->key_len;
 788
 789    if (req->src_len != (unsigned int) ctx->key_len) {
 790        err = -EINVAL;
 791        goto rsa_dec_out;
 792    }
 793
 794    if (req->dst_len <= 0 || req->dst_len > (unsigned int) ctx->key_len) {
 795        err = -EINVAL;
 796        goto rsa_dec_out;
 797    }
 798
 799    enc = malloc(req->src_len);
 800    if (unlikely(enc == NULL)) {
 801        err = -ENOMEM;
 802        goto rsa_dec_out;
 803    }
 804
 805    dec = malloc(req->dst_len);
 806    if (unlikely(dec == NULL)) {
 807        err = -ENOMEM;
 808        goto rsa_dec_out;
 809    }
 810
 811    /* copy req->src to enc */
 812    memset(enc, 0, req->src_len);
 813    memset(dec, 0, req->dst_len);
 814    scatterwalk_map_and_copy(enc, req->src, 0, req->src_len, 0);
 815
 816    err = km_rsa_ctx_init_rng(ctx);
 817    if (err)
 818        goto rsa_dec_out;
 819
 820    err = wc_RsaDirect(enc, ctx->key_len, dec, &out_len,
 821                       ctx->key, RSA_PRIVATE_DECRYPT, &ctx->rng);
 822
 823    if (unlikely(err != (int) ctx->key_len || ctx->key_len != out_len)) {
 824        #ifdef WOLFKM_DEBUG_RSA
 825        pr_err("error: %s: rsa pub enc returned: %d, %d, %d\n",
 826               WOLFKM_RSA_DRIVER, err, out_len, ctx->key_len);
 827        #endif /* WOLFKM_DEBUG_RSA */
 828        err = -EINVAL;
 829        goto rsa_dec_out;
 830    }
 831
 832    if (out_len > req->dst_len) {
 833        err = -EOVERFLOW;
 834        goto rsa_dec_out;
 835    }
 836
 837    /* copy dec to req->dst */
 838    scatterwalk_map_and_copy(dec, req->dst, 0, ctx->key_len, 1);
 839
 840    err = 0;
 841rsa_dec_out:
 842    if (enc != NULL) { free(enc); enc = NULL; }
 843    if (dec != NULL) { free(dec); dec = NULL; }
 844
 845    #ifdef WOLFKM_DEBUG_RSA
 846    pr_info("info: exiting km_direct_rsa_dec\n");
 847    #endif /* WOLFKM_DEBUG_RSA */
 848    return err;
 849}
 850#endif /* LINUXKM_DIRECT_RSA */
 851
 852/*
 853 * Decodes and sets the RSA private key.
 854 *
 855 * param tfm     the crypto_akcipher transform
 856 * param key     BER encoded private key and parameters
 857 * param keylen  key length
 858 */
 859static int km_rsa_set_priv(struct crypto_akcipher *tfm, const void *key,
 860                            unsigned int keylen)
 861{
 862    int                 err = 0;
 863    struct km_rsa_ctx * ctx = NULL;
 864    word32              idx = 0;
 865    int                 key_len = 0;
 866
 867    ctx = akcipher_tfm_ctx(tfm);
 868
 869    if (ctx->key_len) {
 870        /* Free old key. */
 871        ctx->key_len = 0;
 872        wc_FreeRsaKey(ctx->key);
 873
 874        err = wc_InitRsaKey(ctx->key, NULL);
 875        if (unlikely(err)) {
 876            return -ENOMEM;
 877        }
 878
 879        /* Note the initialization of ctx->rng is deferred unless/until needed. */
 880        err = wc_RsaSetRNG(ctx->key, &ctx->rng);
 881        if (unlikely(err)) {
 882            return -ENOMEM;
 883        }
 884    }
 885
 886    err = wc_RsaPrivateKeyDecode(key, &idx, ctx->key, keylen);
 887
 888    if (unlikely(err)) {
 889        if (!disable_setkey_warnings) {
 890            pr_err("%s: wc_RsaPrivateKeyDecode failed: %d\n",
 891                   WOLFKM_RSA_DRIVER, err);
 892        }
 893        return -EINVAL;
 894    }
 895
 896    key_len = wc_RsaEncryptSize(ctx->key);
 897    if (unlikely(key_len <= 0)) {
 898        pr_err("error: %s: rsa encrypt size returned: %d\n",
 899               WOLFKM_RSA_DRIVER, key_len);
 900        return -EINVAL;
 901    }
 902
 903    ctx->key_len = (word32) key_len;
 904
 905    #ifdef WOLFKM_DEBUG_RSA
 906    pr_info("info: exiting km_rsa_set_priv: %d\n", keylen);
 907    #endif /* WOLFKM_DEBUG_RSA */
 908    return err;
 909}
 910
 911/*
 912 * Decodes and sets the RSA pub key.
 913 *
 914 * param tfm     the crypto_akcipher transform
 915 * param key     BER encoded pub key and parameters
 916 * param keylen  key length
 917 */
 918static int km_rsa_set_pub(struct crypto_akcipher *tfm, const void *key,
 919                           unsigned int keylen)
 920{
 921    int                 err = 0;
 922    struct km_rsa_ctx * ctx = NULL;
 923    word32              idx = 0;
 924    int                 key_len = 0;
 925
 926    ctx = akcipher_tfm_ctx(tfm);
 927
 928    if (ctx->key_len) {
 929        /* Free old key. */
 930        ctx->key_len = 0;
 931        wc_FreeRsaKey(ctx->key);
 932
 933        err = wc_InitRsaKey(ctx->key, NULL);
 934        if (unlikely(err)) {
 935            return -ENOMEM;
 936        }
 937
 938        /* Note the initialization of ctx->rng is deferred unless/until needed. */
 939        err = wc_RsaSetRNG(ctx->key, &ctx->rng);
 940        if (unlikely(err)) {
 941            return -ENOMEM;
 942        }
 943    }
 944
 945    err = wc_RsaPublicKeyDecode(key, &idx, ctx->key, keylen);
 946
 947    if (unlikely(err)) {
 948        #ifdef WOLFKM_DEBUG_RSA
 949        pr_err("%s: wc_RsaPublicKeyDecode failed: %d\n",
 950               WOLFKM_RSA_DRIVER, err);
 951        #endif /* WOLFKM_DEBUG_RSA */
 952        return -EINVAL;
 953    }
 954
 955    key_len = wc_RsaEncryptSize(ctx->key);
 956    if (unlikely(key_len <= 0)) {
 957        #ifdef WOLFKM_DEBUG_RSA
 958        pr_err("error: %s: rsa encrypt size returned: %d\n",
 959               WOLFKM_RSA_DRIVER, key_len);
 960        #endif /* WOLFKM_DEBUG_RSA */
 961        return -EINVAL;
 962    }
 963
 964    ctx->key_len = (word32) key_len;
 965
 966    #ifdef WOLFKM_DEBUG_RSA
 967    pr_info("info: exiting km_rsa_set_pub %d\n", keylen);
 968    #endif /* WOLFKM_DEBUG_RSA */
 969    return err;
 970}
 971
 972/*
 973 * Returns dest buffer size required for key.
 974 */
 975static unsigned int km_rsa_max_size(struct crypto_akcipher *tfm)
 976{
 977    struct km_rsa_ctx * ctx = NULL;
 978    ctx = akcipher_tfm_ctx(tfm);
 979    return (unsigned int) ctx->key_len;
 980}
 981
 982#if defined(LINUXKM_DIRECT_RSA)
 983static int km_direct_rsa_init(struct crypto_akcipher *tfm)
 984{
 985    struct km_rsa_ctx * ctx = NULL;
 986    ctx = akcipher_tfm_ctx(tfm);
 987    return km_rsa_ctx_init(ctx, 0);
 988}
 989#endif /* LINUXKM_DIRECT_RSA */
 990
 991static void km_rsa_exit(struct crypto_akcipher *tfm)
 992{
 993    struct km_rsa_ctx * ctx = NULL;
 994    ctx = akcipher_tfm_ctx(tfm);
 995    km_rsa_ctx_clear(ctx);
 996    #ifdef WOLFKM_DEBUG_RSA
 997    pr_info("info: exiting km_rsa_exit\n");
 998    #endif /* WOLFKM_DEBUG_RSA */
 999    return;
1000}
1001
1002#if defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
1003    static int km_pkcs1pad_init(struct crypto_akcipher * tfm)
1004    {
1005        struct km_rsa_ctx * ctx = NULL;
1006        ctx = akcipher_tfm_ctx(tfm);
1007        return km_rsa_ctx_init(ctx, 0);
1008    }
1009#endif /* LINUXKM_AKCIPHER_NO_SIGNVERIFY */
1010
1011#ifdef WOLFSSL_SHA224
1012static int km_pkcs1_sha224_init(struct tfm_type *tfm)
1013{
1014    struct km_rsa_ctx * ctx = NULL;
1015    ctx = tfm_ctx_cb(tfm);
1016    return km_rsa_ctx_init(ctx, SHA224h);
1017}
1018#endif /* WOLFSSL_SHA224 */
1019
1020#ifndef NO_SHA256
1021static int km_pkcs1_sha256_init(struct tfm_type *tfm)
1022{
1023    struct km_rsa_ctx * ctx = NULL;
1024    ctx = tfm_ctx_cb(tfm);
1025    return km_rsa_ctx_init(ctx, SHA256h);
1026}
1027#endif /* !NO_SHA256 */
1028
1029#ifdef WOLFSSL_SHA384
1030static int km_pkcs1_sha384_init(struct tfm_type *tfm)
1031{
1032    struct km_rsa_ctx * ctx = NULL;
1033    ctx = tfm_ctx_cb(tfm);
1034    return km_rsa_ctx_init(ctx, SHA384h);
1035}
1036#endif /* WOLFSSL_SHA384 */
1037
1038#ifdef WOLFSSL_SHA512
1039static int km_pkcs1_sha512_init(struct tfm_type *tfm)
1040{
1041    struct km_rsa_ctx * ctx = NULL;
1042    ctx = tfm_ctx_cb(tfm);
1043    return km_rsa_ctx_init(ctx, SHA512h);
1044}
1045#endif /* WOLFSSL_SHA512 */
1046#ifdef WOLFSSL_SHA3
1047static int km_pkcs1_sha3_256_init(struct tfm_type *tfm)
1048{
1049    struct km_rsa_ctx * ctx = NULL;
1050    ctx = tfm_ctx_cb(tfm);
1051    return km_rsa_ctx_init(ctx, SHA3_256h);
1052}
1053
1054static int km_pkcs1_sha3_384_init(struct tfm_type *tfm)
1055{
1056    struct km_rsa_ctx * ctx = NULL;
1057    ctx = tfm_ctx_cb(tfm);
1058    return km_rsa_ctx_init(ctx, SHA3_384h);
1059}
1060
1061static int km_pkcs1_sha3_512_init(struct tfm_type *tfm)
1062{
1063    struct km_rsa_ctx * ctx = NULL;
1064    ctx = tfm_ctx_cb(tfm);
1065    return km_rsa_ctx_init(ctx, SHA3_512h);
1066}
1067#endif /* WOLFSSL_SHA3 */
1068
1069#if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
1070/*
1071 * Generates a pkcs1 encoded signature.
1072 *
1073 * src:
1074 *   - req->src scatterlist is the digest to be encoded, padded, and signed.
1075 *   - req->src_len + encoding + min padding must be <= key_size.
1076 *
1077 * dst:
1078 *   - req->dst scatterlist is destination signature.
1079 *   - req->dst_len must be >= key_len size.
1080 *
1081 * See kernel (6.12 or earlier):
1082 *   - include/crypto/akcipher.h
1083 */
1084static int km_pkcs1pad_sign(struct akcipher_request *req)
1085{
1086    struct crypto_akcipher * tfm = NULL;
1087    struct km_rsa_ctx *      ctx = NULL;
1088    int                      err = 0;
1089    word32                   sig_len = 0;
1090    word32                   enc_len = 0;
1091    int                      hash_enc_len = 0;
1092    byte *                   msg = NULL;
1093    byte *                   sig = NULL;
1094    byte *                   work_buffer = NULL;
1095
1096    if (req->src == NULL || req->dst == NULL) {
1097        err = -EINVAL;
1098        goto pkcs1pad_sign_out;
1099    }
1100
1101    tfm = crypto_akcipher_reqtfm(req);
1102    ctx = akcipher_tfm_ctx(tfm);
1103
1104    if (ctx->key_len <= 0 || ctx->digest_len <= 0) {
1105        /* invalid key state */
1106        err = -EINVAL;
1107        goto pkcs1pad_sign_out;
1108    }
1109
1110    hash_enc_len = get_hash_enc_len(ctx->hash_oid);
1111    if (hash_enc_len <= 0) {
1112        err = -EINVAL;
1113        goto pkcs1pad_sign_out;
1114    }
1115
1116    if (req->src_len + hash_enc_len + RSA_MIN_PAD_SZ > ctx->key_len) {
1117        err = -EOVERFLOW;
1118        goto pkcs1pad_sign_out;
1119    }
1120
1121    if (req->dst_len < ctx->key_len) {
1122        err = -EOVERFLOW;
1123        goto pkcs1pad_sign_out;
1124    }
1125
1126    work_buffer = malloc(2 * ctx->key_len);
1127    if (unlikely(work_buffer == NULL)) {
1128        err = -ENOMEM;
1129        goto pkcs1pad_sign_out;
1130    }
1131
1132    memset(work_buffer, 0, 2 * ctx->key_len);
1133    msg = work_buffer;
1134    sig = work_buffer + ctx->key_len;
1135
1136    /* copy req->src to msg */
1137    scatterwalk_map_and_copy(msg, req->src, 0, req->src_len, 0);
1138
1139    /* encode message with hash oid. */
1140    enc_len = wc_EncodeSignature(msg, msg, req->src_len, ctx->hash_oid);
1141    if (unlikely(enc_len <= 0)) {
1142        #ifdef WOLFKM_DEBUG_RSA
1143        pr_err("error: %s: wc_EncodeSignature returned: %d\n",
1144               WOLFKM_RSA_DRIVER, enc_len);
1145        #endif /* WOLFKM_DEBUG_RSA */
1146        err = -EINVAL;
1147        goto pkcs1pad_sign_out;
1148    }
1149
1150    err = km_rsa_ctx_init_rng(ctx);
1151    if (err)
1152        goto pkcs1pad_sign_out;
1153
1154    /* sign encoded message. */
1155    sig_len = wc_RsaSSL_Sign(msg, enc_len, sig,
1156                             ctx->key_len, ctx->key, &ctx->rng);
1157    if (unlikely(sig_len != ctx->key_len)) {
1158        #ifdef WOLFKM_DEBUG_RSA
1159        pr_err("error: %s: wc_RsaSSL_Sign returned: %d\n",
1160               WOLFKM_RSA_DRIVER, sig_len);
1161        #endif /* WOLFKM_DEBUG_RSA */
1162        err = -EINVAL;
1163        goto pkcs1pad_sign_out;
1164    }
1165
1166    /* copy sig to req->dst */
1167    scatterwalk_map_and_copy(sig, req->dst, 0, ctx->key_len, 1);
1168
1169    err = 0;
1170pkcs1pad_sign_out:
1171    if (work_buffer != NULL) { free(work_buffer); work_buffer = NULL; }
1172
1173    #ifdef WOLFKM_DEBUG_RSA
1174    pr_info("info: exiting km_pkcs1pad_sign msg_len %d, enc_msg_len %d,"
1175            " sig_len %d, err %d\n", req->src_len, enc_len, sig_len, err);
1176    #endif /* WOLFKM_DEBUG_RSA */
1177    return err;
1178}
1179
1180/*
1181 * Verify a pkcs1 encoded signature.
1182 *
1183 * The total size of req->src is src_len + dst_len:
1184 *   - src_len: signature
1185 *   - dst_len: digest
1186 *
1187 * dst should be null.
1188 * See kernel (6.12 or earlier):
1189 *   - include/crypto/akcipher.h
1190 */
1191static int km_pkcs1pad_verify(struct akcipher_request *req)
1192{
1193    struct crypto_akcipher * tfm = NULL;
1194    struct km_rsa_ctx *      ctx = NULL;
1195    int                      err = 0;
1196    word32                   sig_len = 0;
1197    word32                   dec_len = 0;
1198    word32                   msg_len = 0;
1199    word32                   enc_msg_len = 0;
1200    int                      hash_enc_len = 0;
1201    int                      n_diff = 0;
1202    byte *                   sig = NULL;
1203    byte *                   msg = NULL;
1204    byte *                   work_buffer = NULL;
1205
1206    if (req->src == NULL || req->dst != NULL) {
1207        err = -EINVAL;
1208        goto pkcs1pad_verify_out;
1209    }
1210
1211    tfm = crypto_akcipher_reqtfm(req);
1212    ctx = akcipher_tfm_ctx(tfm);
1213
1214    msg_len = req->dst_len;
1215    sig_len = req->src_len;
1216
1217    if (ctx->key_len <= 0 || ctx->digest_len <= 0) {
1218        /* invalid key state */
1219        err = -EINVAL;
1220        goto pkcs1pad_verify_out;
1221    }
1222
1223    hash_enc_len = get_hash_enc_len(ctx->hash_oid);
1224    if (hash_enc_len <= 0) {
1225        #ifdef WOLFKM_DEBUG_RSA
1226        pr_err("error: %s: bad hash enc len %d\n",
1227               WOLFKM_RSA_DRIVER, hash_enc_len);
1228        #endif /* WOLFKM_DEBUG_RSA */
1229        err = -EINVAL;
1230        goto pkcs1pad_verify_out;
1231    }
1232
1233    if (msg_len != ctx->digest_len || sig_len != ctx->key_len) {
1234        /* invalid src or dst args */
1235        #ifdef WOLFKM_DEBUG_RSA
1236        pr_err("error: %s: got msg_len %d, expected %d\n",
1237               WOLFKM_RSA_DRIVER, msg_len, ctx->digest_len);
1238        #endif /* WOLFKM_DEBUG_RSA */
1239        err = -EINVAL;
1240        goto pkcs1pad_verify_out;
1241    }
1242
1243    work_buffer = malloc(2 * ctx->key_len);
1244    if (unlikely(work_buffer == NULL)) {
1245        err = -ENOMEM;
1246        goto pkcs1pad_verify_out;
1247    }
1248
1249    memset(work_buffer, 0, 2 * ctx->key_len);
1250    msg = work_buffer;
1251    sig = work_buffer + ctx->key_len;
1252
1253    /* copy sig from req->src to sig */
1254    scatterwalk_map_and_copy(sig, req->src, 0, sig_len, 0);
1255
1256    /* verify encoded message. */
1257    dec_len = wc_RsaSSL_Verify(sig, sig_len, msg, sig_len, ctx->key);
1258    if (unlikely(dec_len <= 0)) {
1259        #ifdef WOLFKM_DEBUG_RSA
1260        pr_err("error: %s: wc_RsaSSL_Verify returned: %d\n",
1261               WOLFKM_RSA_DRIVER, dec_len);
1262        #endif /* WOLFKM_DEBUG_RSA */
1263        err = -EBADMSG;
1264        goto pkcs1pad_verify_out;
1265    }
1266
1267    /* reuse sig array for digest comparison */
1268    memset(sig, 0, ctx->key_len);
1269    scatterwalk_map_and_copy(sig, req->src, sig_len, msg_len, 0);
1270
1271    /* encode digest with hash oid. */
1272    enc_msg_len = wc_EncodeSignature(sig, sig, msg_len, ctx->hash_oid);
1273    if (unlikely(enc_msg_len <= 0 || enc_msg_len != dec_len)) {
1274        err = -EINVAL;
1275        goto pkcs1pad_verify_out;
1276    }
1277
1278    n_diff = memcmp(sig, msg, dec_len);
1279    if (unlikely(n_diff != 0)) {
1280        err = -EKEYREJECTED;
1281        goto pkcs1pad_verify_out;
1282    }
1283
1284    err = 0;
1285pkcs1pad_verify_out:
1286    if (work_buffer != NULL) { free(work_buffer); work_buffer = NULL; }
1287
1288    #ifdef WOLFKM_DEBUG_RSA
1289    pr_info("info: exiting km_pkcs1pad_verify msg_len %d, enc_msg_len %d,"
1290            " sig_len %d, err %d\n", msg_len, enc_msg_len, sig_len, err);
1291    #endif /* WOLFKM_DEBUG_RSA */
1292    return err;
1293}
1294#else
1295
1296/* Returns the rsa key size:
1297 *   linux kernel version <  6.15.3: returns key size in bytes.
1298 *   linux kernel version >= 6.15.3: returns key size in bits.
1299 * */
1300static unsigned int km_pkcs1_key_size(struct crypto_sig *tfm)
1301{
1302    struct km_rsa_ctx * ctx = NULL;
1303
1304    ctx = crypto_sig_ctx(tfm);
1305
1306    #if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 3)
1307    return (unsigned int) ctx->key_len * WOLFSSL_BIT_SIZE;
1308    #else
1309    return (unsigned int) ctx->key_len;
1310    #endif /* linux >= 6.15.3 */
1311}
1312
1313/*
1314 * Generates a pkcs1 encoded signature.
1315 *
1316 * src:
1317 *   - src contains the digest to be encoded, padded, and signed.
1318 *   - slen + encoding + min padding must be <= key_size.
1319 *
1320 * dst:
1321 *   - dst is destination signature buffer.
1322 *   - dlen must be >= key_len size.
1323 *
1324 * Returns signature length on success.
1325 * Returns < 0 on error.
1326 *
1327 * See kernel (6.13 or later):
1328 *   - include/crypto/sig.h
1329 */
1330static int km_pkcs1_sign(struct crypto_sig *tfm,
1331                         const void *src, unsigned int slen,
1332                         void *dst, unsigned int dlen)
1333{
1334    struct km_rsa_ctx * ctx = NULL;
1335    int                 err = 0;
1336    word32              sig_len = 0;
1337    word32              enc_msg_len = 0;
1338    int                 hash_enc_len = 0;
1339    byte *              msg = NULL;
1340    byte *              sig = dst; /* reuse dst buffer. we will check if
1341                                    * it is large enough. */
1342
1343    if (src == NULL || dst == NULL) {
1344        err = -EINVAL;
1345        goto pkcs1_sign_out;
1346    }
1347
1348    ctx = crypto_sig_ctx(tfm);
1349
1350    if (ctx->key_len <= 0 || ctx->digest_len <= 0) {
1351        /* invalid key state */
1352        err = -EINVAL;
1353        goto pkcs1_sign_out;
1354    }
1355
1356    hash_enc_len = get_hash_enc_len(ctx->hash_oid);
1357    if (hash_enc_len <= 0) {
1358        err = -EINVAL;
1359        goto pkcs1_sign_out;
1360    }
1361
1362    if (slen + hash_enc_len + RSA_MIN_PAD_SZ > ctx->key_len) {
1363        err = -EOVERFLOW;
1364        goto pkcs1_sign_out;
1365    }
1366
1367    if (dlen < ctx->key_len) {
1368        err = -EOVERFLOW;
1369        goto pkcs1_sign_out;
1370    }
1371
1372    /* allocate extra space for encoding. */
1373    msg = malloc(ctx->key_len);
1374    if (unlikely(msg == NULL)) {
1375        err = -ENOMEM;
1376        goto pkcs1_sign_out;
1377    }
1378
1379    /* copy src to msg, and clear buffers. */
1380    memset(msg, 0, ctx->key_len);
1381    memset(sig, 0, ctx->key_len);
1382    memcpy(msg, src, slen);
1383
1384    /* encode message with hash oid. */
1385    enc_msg_len = wc_EncodeSignature(msg, msg, slen, ctx->hash_oid);
1386    if (unlikely(enc_msg_len <= 0)) {
1387        #ifdef WOLFKM_DEBUG_RSA
1388        pr_err("error: %s: wc_EncodeSignature returned: %d\n",
1389               WOLFKM_RSA_DRIVER, enc_msg_len);
1390        #endif /* WOLFKM_DEBUG_RSA */
1391        err = -EINVAL;
1392        goto pkcs1_sign_out;
1393    }
1394
1395    err = km_rsa_ctx_init_rng(ctx);
1396    if (err)
1397        goto pkcs1_sign_out;
1398
1399    /* sign encoded message. */
1400    sig_len = wc_RsaSSL_Sign(msg, enc_msg_len, sig,
1401                             ctx->key_len, ctx->key, &ctx->rng);
1402    if (unlikely(sig_len != ctx->key_len)) {
1403        #ifdef WOLFKM_DEBUG_RSA
1404        pr_err("error: %s: wc_RsaSSL_Sign returned: %d\n",
1405               WOLFKM_RSA_DRIVER, sig_len);
1406        #endif /* WOLFKM_DEBUG_RSA */
1407        err = -EINVAL;
1408        goto pkcs1_sign_out;
1409    }
1410
1411    /* in 6.15 crypto_sig_sign switched from returning 0 on success to
1412     * returning sig_len. */
1413    #if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0)
1414    err = sig_len;
1415    #else
1416    err = 0;
1417    #endif /* linux >= 6.15.0 */
1418pkcs1_sign_out:
1419    if (msg != NULL) { free(msg); msg = NULL; }
1420
1421    #ifdef WOLFKM_DEBUG_RSA
1422    pr_info("info: exiting km_pkcs1_sign msg_len %d, enc_msg_len %d,"
1423            " sig_len %d, err %d\n", slen, enc_msg_len, sig_len, err);
1424    #endif /* WOLFKM_DEBUG_RSA */
1425    return err;
1426}
1427
1428/*
1429 * Verify a pkcs1 encoded signature.
1430 *
1431 * src:
1432 *   - src contains the signature.
1433 *   - slen must == key_size
1434 *
1435 * digest:
1436 *   - the digest that was encoded, padded, and signed previously.
1437 *   - dlen must be the correct digest len.
1438 *
1439 * See kernel (6.13 or later):
1440 *   - include/crypto/sig.h
1441 */
1442static int km_pkcs1_verify(struct crypto_sig *tfm,
1443                           const void *src, unsigned int slen,
1444                           const void *digest, unsigned int dlen)
1445{
1446    struct km_rsa_ctx * ctx = NULL;
1447    int                 err = 0;
1448    word32              sig_len = 0;
1449    word32              dec_len = 0;
1450    word32              msg_len = 0;
1451    word32              enc_msg_len = 0;
1452    int                 hash_enc_len = 0;
1453    int                 n_diff = 0;
1454    byte *              enc_digest = NULL;
1455    byte *              msg = NULL;
1456    byte *              work_buffer = NULL;
1457
1458    if (src == NULL || digest == NULL) {
1459        err = -EINVAL;
1460        goto pkcs1_verify_out;
1461    }
1462
1463    ctx = crypto_sig_ctx(tfm);
1464
1465    msg_len = dlen;
1466    sig_len = slen;
1467
1468    if (ctx->key_len <= 0 || ctx->digest_len <= 0) {
1469        /* invalid key state */
1470        err = -EINVAL;
1471        goto pkcs1_verify_out;
1472    }
1473
1474    hash_enc_len = get_hash_enc_len(ctx->hash_oid);
1475    if (hash_enc_len <= 0) {
1476        #ifdef WOLFKM_DEBUG_RSA
1477        pr_err("error: %s: bad hash enc len %d\n",
1478               WOLFKM_RSA_DRIVER, hash_enc_len);
1479        #endif /* WOLFKM_DEBUG_RSA */
1480        err = -EINVAL;
1481        goto pkcs1_verify_out;
1482    }
1483
1484    if (msg_len != ctx->digest_len || sig_len != ctx->key_len) {
1485        /* invalid src or dst args */
1486        #ifdef WOLFKM_DEBUG_RSA
1487        pr_err("error: %s: got msg_len %d, expected %d\n",
1488               WOLFKM_RSA_DRIVER, msg_len, ctx->digest_len);
1489        #endif /* WOLFKM_DEBUG_RSA */
1490        err = -EINVAL;
1491        goto pkcs1_verify_out;
1492    }
1493
1494    work_buffer = malloc(2 * ctx->key_len);
1495    if (unlikely(work_buffer == NULL)) {
1496        err = -ENOMEM;
1497        goto pkcs1_verify_out;
1498    }
1499
1500    memset(work_buffer, 0, 2 * ctx->key_len);
1501    msg = work_buffer;
1502    enc_digest = work_buffer + ctx->key_len;
1503
1504    /* verify encoded message. msg contains recovered original message. */
1505    dec_len = wc_RsaSSL_Verify(src, sig_len, msg, sig_len, ctx->key);
1506    if (unlikely(dec_len <= 0)) {
1507        #ifdef WOLFKM_DEBUG_RSA
1508        pr_err("error: %s: wc_RsaSSL_Verify returned: %d\n",
1509               WOLFKM_RSA_DRIVER, dec_len);
1510        #endif /* WOLFKM_DEBUG_RSA */
1511        err = -EBADMSG;
1512        goto pkcs1_verify_out;
1513    }
1514
1515    memcpy(enc_digest, digest, msg_len);
1516
1517    /* encode digest with hash oid. */
1518    enc_msg_len = wc_EncodeSignature(enc_digest, enc_digest, msg_len,
1519                                     ctx->hash_oid);
1520    if (unlikely(enc_msg_len <= 0 || enc_msg_len != dec_len)) {
1521        err = -EINVAL;
1522        goto pkcs1_verify_out;
1523    }
1524
1525    n_diff = memcmp(enc_digest, msg, enc_msg_len);
1526    if (unlikely(n_diff != 0)) {
1527        #ifdef WOLFKM_DEBUG_RSA
1528        pr_err("error: %s: recovered msg did not match digest: %d\n",
1529               WOLFKM_RSA_DRIVER, n_diff);
1530        #endif /* WOLFKM_DEBUG_RSA */
1531        err = -EKEYREJECTED;
1532        goto pkcs1_verify_out;
1533    }
1534
1535    err = 0;
1536pkcs1_verify_out:
1537    if (work_buffer != NULL) { free(work_buffer); work_buffer = NULL; }
1538
1539    #ifdef WOLFKM_DEBUG_RSA
1540    pr_info("info: exiting km_pkcs1_verify msg_len %d, enc_msg_len %d,"
1541            " sig_len %d, err %d\n", msg_len, enc_msg_len, sig_len, err);
1542    #endif /* WOLFKM_DEBUG_RSA */
1543    return err;
1544}
1545
1546static int km_pkcs1_set_priv(struct crypto_sig *tfm, const void *key,
1547                             unsigned int keylen)
1548{
1549    int                 err = 0;
1550    struct km_rsa_ctx * ctx = NULL;
1551    word32              idx = 0;
1552    int                 key_len = 0;
1553
1554    ctx = crypto_sig_ctx(tfm);
1555
1556    if (ctx->key_len) {
1557        /* Free old key. */
1558        ctx->key_len = 0;
1559        wc_FreeRsaKey(ctx->key);
1560
1561        err = wc_InitRsaKey(ctx->key, NULL);
1562        if (unlikely(err)) {
1563            return -ENOMEM;
1564        }
1565
1566        /* Note the initialization of ctx->rng is deferred unless/until needed. */
1567        err = wc_RsaSetRNG(ctx->key, &ctx->rng);
1568        if (unlikely(err)) {
1569            return -ENOMEM;
1570        }
1571    }
1572
1573    err = wc_RsaPrivateKeyDecode(key, &idx, ctx->key, keylen);
1574
1575    if (unlikely(err)) {
1576        if (!disable_setkey_warnings) {
1577            pr_err("%s: wc_RsaPrivateKeyDecode failed: %d\n",
1578                   WOLFKM_RSA_DRIVER, err);
1579        }
1580        return -EINVAL;
1581    }
1582
1583    key_len = wc_RsaEncryptSize(ctx->key);
1584    if (unlikely(key_len <= 0)) {
1585        pr_err("error: %s: rsa encrypt size returned: %d\n",
1586               WOLFKM_RSA_DRIVER, key_len);
1587        return -EINVAL;
1588    }
1589
1590    ctx->key_len = (word32) key_len;
1591
1592    #ifdef WOLFKM_DEBUG_RSA
1593    pr_info("info: exiting km_pkcs1_set_priv: %d\n", keylen);
1594    #endif /* WOLFKM_DEBUG_RSA */
1595    return err;
1596}
1597
1598static int km_pkcs1_set_pub(struct crypto_sig *tfm, const void *key,
1599                            unsigned int keylen)
1600{
1601    int                 err = 0;
1602    struct km_rsa_ctx * ctx = NULL;
1603    word32              idx = 0;
1604    int                 key_len = 0;
1605
1606    ctx = crypto_sig_ctx(tfm);
1607
1608    if (ctx->key_len) {
1609        /* Free old key. */
1610        ctx->key_len = 0;
1611        wc_FreeRsaKey(ctx->key);
1612
1613        err = wc_InitRsaKey(ctx->key, NULL);
1614        if (unlikely(err)) {
1615            return -ENOMEM;
1616        }
1617    }
1618
1619    err = wc_RsaPublicKeyDecode(key, &idx, ctx->key, keylen);
1620
1621    if (unlikely(err)) {
1622        #ifdef WOLFKM_DEBUG_RSA
1623        pr_err("%s: wc_RsaPublicKeyDecode failed: %d\n",
1624               WOLFKM_RSA_DRIVER, err);
1625        #endif /* WOLFKM_DEBUG_RSA */
1626        return -EINVAL;
1627    }
1628
1629    key_len = wc_RsaEncryptSize(ctx->key);
1630    if (unlikely(key_len <= 0)) {
1631        #ifdef WOLFKM_DEBUG_RSA
1632        pr_err("error: %s: rsa encrypt size returned: %d\n",
1633               WOLFKM_RSA_DRIVER, key_len);
1634        #endif /* WOLFKM_DEBUG_RSA */
1635        return -EINVAL;
1636    }
1637
1638    ctx->key_len = (word32) key_len;
1639
1640    #ifdef WOLFKM_DEBUG_RSA
1641    pr_info("info: exiting km_pkcs1_set_pub %d\n", keylen);
1642    #endif /* WOLFKM_DEBUG_RSA */
1643    return err;
1644}
1645
1646static void km_pkcs1_exit(struct crypto_sig *tfm)
1647{
1648    struct km_rsa_ctx * ctx = NULL;
1649
1650    ctx = crypto_sig_ctx(tfm);
1651
1652    km_rsa_ctx_clear(ctx);
1653
1654    #ifdef WOLFKM_DEBUG_RSA
1655    pr_info("info: exiting km_pkcs1_exit\n");
1656    #endif /* WOLFKM_DEBUG_RSA */
1657    return;
1658}
1659#endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
1660
1661static int km_pkcs1pad_enc(struct akcipher_request *req)
1662{
1663    struct crypto_akcipher * tfm = NULL;
1664    struct km_rsa_ctx *      ctx = NULL;
1665    int                      err = 0;
1666    byte *                   dec = NULL;
1667    byte *                   enc = NULL;
1668
1669    if (req->src == NULL || req->dst == NULL) {
1670        err = -EINVAL;
1671        goto pkcs1_enc_out;
1672    }
1673
1674    tfm = crypto_akcipher_reqtfm(req);
1675    ctx = akcipher_tfm_ctx(tfm);
1676
1677    if (ctx->key_len <= 0) {
1678        /* invalid key state */
1679        err = -EINVAL;
1680        goto pkcs1_enc_out;
1681    }
1682
1683    if (req->src_len + RSA_MIN_PAD_SZ > ctx->key_len) {
1684        err = -EOVERFLOW;
1685        goto pkcs1_enc_out;
1686    }
1687
1688    if (req->dst_len < ctx->key_len) {
1689        err = -EOVERFLOW;
1690        goto pkcs1_enc_out;
1691    }
1692
1693    dec = malloc(req->src_len);
1694    if (unlikely(dec == NULL)) {
1695        err = -ENOMEM;
1696        goto pkcs1_enc_out;
1697    }
1698
1699    enc = malloc(req->dst_len);
1700    if (unlikely(enc == NULL)) {
1701        err = -ENOMEM;
1702        goto pkcs1_enc_out;
1703    }
1704
1705    /* copy req->src to dec */
1706    memset(dec, 0, req->src_len);
1707    memset(enc, 0, req->dst_len);
1708    scatterwalk_map_and_copy(dec, req->src, 0, req->src_len, 0);
1709
1710    err = km_rsa_ctx_init_rng(ctx);
1711    if (err)
1712        goto pkcs1_enc_out;
1713
1714    err = wc_RsaPublicEncrypt(dec, req->src_len, enc, ctx->key_len,
1715                              ctx->key, &ctx->rng);
1716
1717    if (unlikely(err != (int) ctx->key_len)) {
1718        #ifdef WOLFKM_DEBUG_RSA
1719        pr_err("error: %s: rsa pub enc returned: %d, %d\n",
1720               WOLFKM_RSA_DRIVER, err, ctx->key_len);
1721        #endif /* WOLFKM_DEBUG_RSA */
1722        err = -EINVAL;
1723        goto pkcs1_enc_out;
1724    }
1725
1726    /* copy enc to req->dst */
1727    scatterwalk_map_and_copy(enc, req->dst, 0, ctx->key_len, 1);
1728
1729    err = 0;
1730pkcs1_enc_out:
1731    if (enc != NULL) { free(enc); enc = NULL; }
1732    if (dec != NULL) { free(dec); dec = NULL; }
1733    #ifdef WOLFKM_DEBUG_RSA
1734    pr_info("info: exiting km_pkcs1pad_enc %d\n", err);
1735    #endif /* WOLFKM_DEBUG_RSA */
1736    return err;
1737}
1738
1739static int km_pkcs1pad_dec(struct akcipher_request *req)
1740{
1741    struct crypto_akcipher * tfm = NULL;
1742    struct km_rsa_ctx *      ctx = NULL;
1743    int                      err = 0;
1744    word32                   dec_len = 0;
1745    byte *                   enc = NULL;
1746    byte *                   dec = NULL;
1747
1748    if (req->src == NULL || req->dst == NULL) {
1749        err = -EINVAL;
1750        goto pkcs1_dec_out;
1751    }
1752
1753    tfm = crypto_akcipher_reqtfm(req);
1754    ctx = akcipher_tfm_ctx(tfm);
1755
1756    if (ctx->key_len <= 0) {
1757        err = -EINVAL;
1758        goto pkcs1_dec_out;
1759    }
1760
1761    if (req->src_len != ctx->key_len) {
1762        err = -EINVAL;
1763        goto pkcs1_dec_out;
1764    }
1765
1766    if (req->dst_len <= 0 || req->dst_len > (unsigned int) ctx->key_len) {
1767        err = -EINVAL;
1768        goto pkcs1_dec_out;
1769    }
1770
1771    enc = malloc(req->src_len);
1772    if (unlikely(enc == NULL)) {
1773        err = -ENOMEM;
1774        goto pkcs1_dec_out;
1775    }
1776
1777    dec = malloc(req->dst_len);
1778    if (unlikely(dec == NULL)) {
1779        err = -ENOMEM;
1780        goto pkcs1_dec_out;
1781    }
1782
1783    /* copy req->src to enc */
1784    memset(enc, 0, req->src_len);
1785    memset(dec, 0, req->dst_len);
1786    scatterwalk_map_and_copy(enc, req->src, 0, req->src_len, 0);
1787
1788#ifdef WC_RSA_BLINDING
1789    err = km_rsa_ctx_init_rng(ctx);
1790    if (err)
1791        goto pkcs1_dec_out;
1792#endif
1793
1794    dec_len = wc_RsaPrivateDecrypt(enc, ctx->key_len, dec, req->dst_len,
1795                                   ctx->key);
1796
1797    if (unlikely(dec_len <= 0 || dec_len > ctx->key_len)) {
1798        #ifdef WOLFKM_DEBUG_RSA
1799        pr_err("error: %s: rsa private decrypt returned: %d, %d\n",
1800               WOLFKM_RSA_DRIVER, dec_len, ctx->key_len);
1801        #endif /* WOLFKM_DEBUG_RSA */
1802        err = -EINVAL;
1803        goto pkcs1_dec_out;
1804    }
1805
1806    if (dec_len > req->dst_len) {
1807        err = -EOVERFLOW;
1808        goto pkcs1_dec_out;
1809    }
1810
1811    /* copy dec to req->dst */
1812    scatterwalk_map_and_copy(dec, req->dst, 0, dec_len, 1);
1813
1814    err = 0;
1815pkcs1_dec_out:
1816    if (enc != NULL) { free(enc); enc = NULL; }
1817    if (dec != NULL) { free(dec); dec = NULL; }
1818
1819    #ifdef WOLFKM_DEBUG_RSA
1820    pr_info("info: exiting km_pkcs1pad_dec %d\n", err);
1821    #endif /* WOLFKM_DEBUG_RSA */
1822    return err;
1823}
1824
1825#if defined(LINUXKM_DIRECT_RSA) && defined(WC_RSA_NO_PADDING)
1826/*
1827 * Tests implemented below.
1828 */
1829static int linuxkm_test_rsa(void)
1830{
1831    int rc = 0;
1832    rc = rsa_no_pad_test();
1833    if (rc != 0) {
1834        pr_err("rsa_no_pad_test() failed with retval %d.\n", rc);
1835        return rc;
1836    }
1837
1838    #ifdef WOLFSSL_KEY_GEN
1839    /* test wolfcrypt RSA API vs wolfkm RSA driver. */
1840    rc = linuxkm_test_rsa_driver(WOLFKM_RSA_DRIVER, 2048);
1841    if (rc) { return rc; }
1842
1843    #ifdef WOLFKM_DEBUG_RSA
1844    rc = linuxkm_test_rsa_driver(WOLFKM_RSA_DRIVER, 3072);
1845    if (rc) { return rc; }
1846
1847    rc = linuxkm_test_rsa_driver(WOLFKM_RSA_DRIVER, 4096);
1848    if (rc) { return rc; }
1849
1850    #ifdef WOLFKM_DEBUG_RSA_GENERIC
1851    /* repeat test against stock linux RSA akcipher. */
1852    rc = linuxkm_test_rsa_driver("rsa-generic", 2048);
1853    if (rc) { return rc; }
1854
1855    rc = linuxkm_test_rsa_driver("rsa-generic", 3072);
1856    if (rc) { return rc; }
1857
1858    rc = linuxkm_test_rsa_driver("rsa-generic", 4096);
1859    if (rc) { return rc; }
1860    #endif /* WOLFKM_DEBUG_RSA_GENERIC */
1861    #endif /* WOLFKM_DEBUG_RSA */
1862    #endif /* WOLFSSL_KEY_GEN */
1863
1864    return rc;
1865}
1866#endif /* LINUXKM_DIRECT_RSA */
1867
1868#if defined(WOLFSSL_KEY_GEN)
1869
1870typedef int (*pkcs1_test_t)(const char * driver, int nbits,
1871                            int hash_oid, word32 hash_len,
1872                            uint8_t optional);
1873/* Test the given pkcs1 wolfcrypt driver and generic driver for a
1874 * hash oid and hash length.
1875 *
1876 * pkcs1_test test callback:
1877 *   - linuxkm_test_pkcs1pad_driver: test old "pkcs1pad(<rsa>, <hash>)"
1878 *     akcipher driver that supports encrypt, decrypt, sign, verify.
1879 *
1880 *   - linuxkm_test_pkcs1_driver: test new "pkcs1(<rsa>, <hash>)" sig driver
1881 *     that supports sign, verify.
1882 * */
1883static int linuxkm_test_pkcs1_hash(const char * wc_driver,
1884                                   const char * generic_driver,
1885                                   int hash_oid, word32 hash_len,
1886                                   pkcs1_test_t pkcs1_test)
1887{
1888    int rc = 0;
1889
1890    rc = pkcs1_test(wc_driver, 2048, hash_oid, hash_len, 0);
1891    if (rc) { return rc; }
1892
1893    #ifdef WOLFKM_DEBUG_RSA
1894    /* repeat with additional key lengths */
1895    rc = pkcs1_test(wc_driver, 3072, hash_oid, hash_len, 0);
1896    if (rc) { return rc; }
1897
1898    rc = pkcs1_test(wc_driver, 4096, hash_oid, hash_len, 0);
1899    if (rc) { return rc; }
1900
1901    #ifdef WOLFKM_DEBUG_RSA_GENERIC
1902    /* repeat tests against stock linux rsa-generic pkcs1pad.
1903     * these are optional, because not all padding variations may
1904     * be available. */
1905    rc = pkcs1_test(generic_driver, 2048, hash_oid, hash_len, 1);
1906    if (rc) { return rc; }
1907
1908    rc = pkcs1_test(generic_driver, 3072, hash_oid, hash_len, 1);
1909    if (rc) { return rc; }
1910
1911    rc = pkcs1_test(generic_driver, 4096, hash_oid, hash_len, 1);
1912    if (rc) { return rc; }
1913    #endif /* WOLFKM_DEBUG_RSA_GENERIC */
1914    #endif /* WOLFKM_DEBUG_RSA */
1915
1916    (void)generic_driver;
1917
1918    return rc;
1919}
1920#endif /* WOLFSSL_KEY_GEN */
1921
1922#if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
1923    /* Use the akcipher "pkcs1pad(<rsa>, <hash>)" driver to test encrypt,
1924     * decrypt, sign, verify. */
1925    #define pkcs1_sign_test_cb linuxkm_test_pkcs1pad_driver
1926#else
1927    /* Use the "pkcs1(<rsa>, <hash>)" driver to test sign, verify. */
1928    #define pkcs1_sign_test_cb linuxkm_test_pkcs1_driver
1929
1930    /* additional test to cover "pkcs1pad(<rsa>)" */
1931    static int linuxkm_test_pkcs1pad(void)
1932    {
1933        int rc = 0;
1934
1935        #if defined(WOLFSSL_KEY_GEN)
1936        rc = linuxkm_test_pkcs1_hash(WOLFKM_PKCS1PAD_DRIVER,
1937                                     "pkcs1pad(rsa-generic)",
1938                                     0 /* hash oid */, 0 /* digest len */,
1939                                     linuxkm_test_pkcs1pad_driver);
1940        #endif /* WOLFSSL_KEY_GEN */
1941
1942        return rc;
1943    }
1944#endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
1945
1946#ifdef WOLFSSL_SHA224
1947static int linuxkm_test_pkcs1_sha224(void)
1948{
1949    int rc = 0;
1950
1951    #if defined(WOLFSSL_KEY_GEN)
1952    rc = linuxkm_test_pkcs1_hash(WOLFKM_PKCS1_SHA224_DRIVER,
1953                                 PKCS1_NAME "(rsa-generic,sha224)",
1954                                 SHA224h, WC_SHA224_DIGEST_SIZE,
1955                                 pkcs1_sign_test_cb);
1956    #endif /* WOLFSSL_KEY_GEN */
1957
1958    return rc;
1959}
1960#endif /* WOLFSSL_SHA224 */
1961
1962#ifndef NO_SHA256
1963static int linuxkm_test_pkcs1_sha256(void)
1964{
1965    int rc = 0;
1966
1967    #if defined(WOLFSSL_KEY_GEN)
1968    rc = linuxkm_test_pkcs1_hash(WOLFKM_PKCS1_SHA256_DRIVER,
1969                                 PKCS1_NAME "(rsa-generic,sha256)",
1970                                 SHA256h, WC_SHA256_DIGEST_SIZE,
1971                                 pkcs1_sign_test_cb);
1972    #endif /* WOLFSSL_KEY_GEN */
1973
1974    return rc;
1975}
1976#endif /* !NO_SHA256 */
1977
1978#ifdef WOLFSSL_SHA384
1979static int linuxkm_test_pkcs1_sha384(void)
1980{
1981    int rc = 0;
1982
1983    #if defined(WOLFSSL_KEY_GEN)
1984    rc = linuxkm_test_pkcs1_hash(WOLFKM_PKCS1_SHA384_DRIVER,
1985                                 PKCS1_NAME "(rsa-generic,sha384)",
1986                                 SHA384h, WC_SHA384_DIGEST_SIZE,
1987                                 pkcs1_sign_test_cb);
1988    #endif /* WOLFSSL_KEY_GEN */
1989
1990    return rc;
1991}
1992#endif /* WOLFSSL_SHA384 */
1993
1994#ifdef WOLFSSL_SHA512
1995static int linuxkm_test_pkcs1_sha512(void)
1996{
1997    int rc = 0;
1998
1999    #if defined(WOLFSSL_KEY_GEN)
2000    rc = linuxkm_test_pkcs1_hash(WOLFKM_PKCS1_SHA512_DRIVER,
2001                                 PKCS1_NAME "(rsa-generic,sha512)",
2002                                 SHA512h, WC_SHA512_DIGEST_SIZE,
2003                                 pkcs1_sign_test_cb);
2004    #endif /* WOLFSSL_KEY_GEN */
2005
2006    return rc;
2007}
2008#endif /* WOLFSSL_SHA512 */
2009
2010#ifdef WOLFSSL_SHA3
2011static int linuxkm_test_pkcs1_sha3_256(void)
2012{
2013    int rc = 0;
2014
2015    #if defined(WOLFSSL_KEY_GEN)
2016    rc = linuxkm_test_pkcs1_hash(WOLFKM_PKCS1_SHA3_256_DRIVER,
2017                                 PKCS1_NAME "(rsa-generic,sha3-256)",
2018                                 SHA3_256h, WC_SHA3_256_DIGEST_SIZE,
2019                                 pkcs1_sign_test_cb);
2020    #endif /* WOLFSSL_KEY_GEN */
2021
2022    return rc;
2023}
2024
2025static int linuxkm_test_pkcs1_sha3_384(void)
2026{
2027    int rc = 0;
2028
2029    #if defined(WOLFSSL_KEY_GEN)
2030    rc = linuxkm_test_pkcs1_hash(WOLFKM_PKCS1_SHA3_384_DRIVER,
2031                                 PKCS1_NAME "(rsa-generic,sha3-384)",
2032                                 SHA3_384h, WC_SHA3_384_DIGEST_SIZE,
2033                                 pkcs1_sign_test_cb);
2034    #endif /* WOLFSSL_KEY_GEN */
2035
2036    return rc;
2037}
2038
2039static int linuxkm_test_pkcs1_sha3_512(void)
2040{
2041    int rc = 0;
2042
2043    #if defined(WOLFSSL_KEY_GEN)
2044    rc = linuxkm_test_pkcs1_hash(WOLFKM_PKCS1_SHA3_512_DRIVER,
2045                                 PKCS1_NAME "(rsa-generic,sha3-512)",
2046                                 SHA3_512h, WC_SHA3_512_DIGEST_SIZE,
2047                                 pkcs1_sign_test_cb);
2048    #endif /* WOLFSSL_KEY_GEN */
2049
2050    return rc;
2051}
2052#endif /* WOLFSSL_SHA3 */
2053
2054#if defined(LINUXKM_DIRECT_RSA) && defined(WOLFSSL_KEY_GEN)
2055/*
2056 * Test linux kernel crypto driver:
2057 *   1. generate RSA key with wolfcrypt.
2058 *   2. sanity check wolfcrypt encrypt + decrypt.
2059 *   3. crypto_alloc_akcipher(driver)
2060 *   4. export wolfcrypt RSA der pub/priv, load to akcipher tfm with
2061 *      crypto_akcipher_set_pub_key, crypto_akcipher_set_priv_key.
2062 *   5. test: kernel public encrypt + wolfcrypt private decrypt
2063 *   6. test: wolfcrypt public encrypt + kernel private decrypt
2064 */
2065static int linuxkm_test_rsa_driver(const char * driver, int nbits)
2066{
2067    int                       test_rc = -1;
2068    int                       ret = 0;
2069    struct crypto_akcipher *  tfm = NULL;
2070    struct akcipher_request * req = NULL;
2071    RsaKey *                  key = NULL;
2072    WC_RNG                    rng;
2073    byte *                    priv = NULL; /* priv der */
2074    word32                    priv_len = 0;
2075    byte *                    pub = NULL; /* pub der */
2076    word32                    pub_len = 0;
2077    byte                      init_rng = 0;
2078    byte                      init_key = 0;
2079    static const byte         p_vector[] =
2080    /* Now is the time for all good men w/o trailing 0 */
2081    {
2082        0x4e,0x6f,0x77,0x20,0x69,0x73,0x20,0x74,
2083        0x68,0x65,0x20,0x74,0x69,0x6d,0x65,0x20,
2084        0x66,0x6f,0x72,0x20,0x61,0x6c,0x6c,0x20,
2085        0x67,0x6f,0x6f,0x64,0x20,0x6d,0x65,0x6e
2086    };
2087    byte *                    enc = NULL;
2088    byte *                    dec = NULL; /* wc decrypt */
2089    byte *                    plaintext = NULL; /* km decrypt */
2090    word32                    key_len = 0;
2091    word32                    out_len = 0;
2092    int                       enc_ret = 0;
2093    int                       dec_ret = 0;
2094    int                       n_diff = 0;
2095    struct scatterlist        src, dst;
2096    size_t                    i = 0;
2097
2098    key = (RsaKey*)malloc(sizeof(RsaKey));
2099    if (key == NULL) {
2100        pr_err("error: allocating key(%zu) failed\n", sizeof(RsaKey));
2101        goto test_rsa_end;
2102    }
2103
2104    memset(&rng, 0, sizeof(rng));
2105    memset(key, 0, sizeof(RsaKey));
2106
2107    ret = LKCAPI_INITRNG(&rng);
2108
2109    if (ret) {
2110        pr_err("error: init rng returned: %d\n", ret);
2111        goto test_rsa_end;
2112    }
2113    init_rng = 1;
2114
2115    ret = wc_InitRsaKey(key, NULL);
2116    if (ret) {
2117        pr_err("error: init rsa key returned: %d\n", ret);
2118        goto test_rsa_end;
2119    }
2120    init_key = 1;
2121
2122    ret = wc_RsaSetRNG(key, &rng);
2123    if (ret) {
2124        pr_err("error: rsa set rng returned: %d\n", ret);
2125        goto test_rsa_end;
2126    }
2127
2128    #ifdef HAVE_FIPS
2129    for (;;) {
2130    #endif
2131        ret = wc_MakeRsaKey(key, nbits, WC_RSA_EXPONENT, &rng);
2132    #ifdef HAVE_FIPS
2133        /* Retry if not prime. */
2134        if (ret == WC_NO_ERR_TRACE(PRIME_GEN_E)) {
2135            continue;
2136        }
2137        break;
2138    }
2139    #endif
2140
2141    if (ret) {
2142        pr_err("error: make rsa key returned: %d\n", ret);
2143        goto test_rsa_end;
2144    }
2145
2146    key_len = wc_RsaEncryptSize(key);
2147    if (key_len <= 0) {
2148        pr_err("error: rsa encrypt size returned: %d\n", key_len);
2149        goto test_rsa_end;
2150    }
2151
2152    /**
2153     * Allocate buffers based on the RsaKey key_len.
2154     *
2155     * Add +1 for dec and plaintext arrays to printf nicely.
2156     * */
2157    enc = (byte*)malloc(key_len);
2158    if (enc == NULL) {
2159        pr_err("error: allocating enc(%d) failed\n", key_len);
2160        goto test_rsa_end;
2161    }
2162
2163    dec = (byte*)malloc(key_len + 1);
2164    if (dec == NULL) {
2165        pr_err("error: allocating dec(%d) failed\n", key_len);
2166        goto test_rsa_end;
2167    }
2168
2169    plaintext = (byte*)malloc(key_len + 1);
2170    if (plaintext == NULL) {
2171        pr_err("error: allocating plaintext(%d) failed\n", key_len);
2172        goto test_rsa_end;
2173    }
2174
2175    memset(enc,  0, key_len);
2176    memset(dec,  0, key_len + 1);
2177    memset(plaintext, 0, key_len + 1);
2178
2179    /* Fill up dec and plaintext with plaintext reference. */
2180    for (i = 0; i < key_len / sizeof(p_vector); ++i) {
2181        memcpy(dec  + i * sizeof(p_vector), p_vector, sizeof(p_vector));
2182        memcpy(plaintext + i * sizeof(p_vector), p_vector, sizeof(p_vector));
2183    }
2184
2185    /**
2186     * Sanity test: first encrypt and decrypt with direct wolfcrypt API.
2187     * */
2188    out_len = key_len;
2189    enc_ret = wc_RsaDirect(dec, key_len, enc, &out_len, key,
2190                           RSA_PUBLIC_ENCRYPT, &rng);
2191    if (enc_ret != (int) key_len || key_len != out_len) {
2192        pr_err("error: rsa pub enc returned: %d, %d\n", enc_ret, out_len);
2193        ret = -1;
2194        goto test_rsa_end;
2195    }
2196
2197    memset(dec, 0, key_len);
2198    dec_ret = wc_RsaDirect(enc, key_len, dec, &out_len, key,
2199                           RSA_PRIVATE_DECRYPT, &rng);
2200    if (dec_ret != (int) key_len || key_len != out_len) {
2201        pr_err("error: rsa priv dec returned: %d, %d\n", dec_ret, out_len);
2202        goto test_rsa_end;
2203    }
2204
2205    /* dec and plaintext should match now. */
2206    n_diff = memcmp(dec, plaintext, key_len);
2207    if (n_diff) {
2208        pr_err("error: decrypt doesn't match plain: %d\n", n_diff);
2209        goto test_rsa_end;
2210    }
2211
2212    /**
2213     * Now export Rsa Der to pub and priv.
2214     * */
2215    priv_len = wc_RsaKeyToDer(key, NULL, 0);
2216    if (priv_len <= 0) {
2217        pr_err("error: rsa priv to der returned: %d\n", priv_len);
2218        goto test_rsa_end;
2219    }
2220
2221    priv = (byte*)malloc(priv_len);
2222    if (priv == NULL) {
2223        pr_err("error: allocating priv(%d) failed\n", priv_len);
2224        goto test_rsa_end;
2225    }
2226
2227    memset(priv, 0, priv_len);
2228
2229    priv_len = wc_RsaKeyToDer(key, priv, priv_len);
2230    if (priv_len <= 0) {
2231        pr_err("error: rsa priv to der returned: %d\n", priv_len);
2232        goto test_rsa_end;
2233    }
2234
2235    /* get rsa pub der */
2236    pub_len = wc_RsaKeyToPublicDer(key, NULL, 0);
2237    if (pub_len <= 0) {
2238        pr_err("error: rsa pub to der returned: %d\n", pub_len);
2239        goto test_rsa_end;
2240    }
2241
2242    pub = (byte*)malloc(pub_len);
2243    if (pub == NULL) {
2244        pr_err("error: allocating pub(%d) failed\n", pub_len);
2245        goto test_rsa_end;
2246    }
2247
2248    memset(pub, 0, pub_len);
2249
2250    pub_len = wc_RsaKeyToPublicDer(key, pub, pub_len);
2251    if (pub_len <= 0) {
2252        pr_err("error: rsa pub to der returned: %d\n", pub_len);
2253        goto test_rsa_end;
2254    }
2255
2256    /**
2257     * Now allocate the akcipher transform, and set up
2258     * the akcipher request.
2259     * */
2260    tfm = crypto_alloc_akcipher(driver, 0, 0);
2261    if (IS_ERR(tfm)) {
2262        pr_err("error: allocating akcipher algorithm %s failed: %ld\n",
2263               driver, PTR_ERR(tfm));
2264        tfm = NULL;
2265        goto test_rsa_end;
2266    }
2267
2268    req = akcipher_request_alloc(tfm, GFP_KERNEL);
2269    if (IS_ERR(req)) {
2270        pr_err("error: allocating akcipher request %s failed\n",
2271               driver);
2272        req = NULL;
2273        goto test_rsa_end;
2274    }
2275
2276    /* now set pub key for verify test. */
2277    ret = crypto_akcipher_set_pub_key(tfm, pub + 24, pub_len - 24);
2278    if (ret) {
2279        pr_err("error: crypto_akcipher_set_pub_key returned: %d\n", ret);
2280        goto test_rsa_end;
2281    }
2282
2283    {
2284        unsigned int maxsize = crypto_akcipher_maxsize(tfm);
2285        if (maxsize != key_len) {
2286            pr_err("error: crypto_akcipher_maxsize "
2287                   "returned %d, expected %d\n", maxsize, key_len);
2288            goto test_rsa_end;
2289        }
2290    }
2291
2292    /* kernel module public encrypt */
2293    sg_init_one(&src, dec, key_len);
2294    sg_init_one(&dst, enc, key_len);
2295
2296    akcipher_request_set_crypt(req, &src, &dst, key_len, key_len);
2297
2298    ret = crypto_akcipher_encrypt(req);
2299    if (ret) {
2300        pr_err("error: crypto_akcipher_encrypt returned: %d\n", ret);
2301        goto test_rsa_end;
2302    }
2303
2304    /* wolfcrypt private decrypt */
2305    memset(dec, 0, key_len + 1);
2306    dec_ret = wc_RsaDirect(enc, key_len, dec, &out_len, key,
2307                           RSA_PRIVATE_DECRYPT, &rng);
2308
2309    if (dec_ret != (int) key_len || key_len != out_len) {
2310        pr_err("error: rsa priv dec returned: %d, %d\n", dec_ret, out_len);
2311        goto test_rsa_end;
2312    }
2313
2314    n_diff = memcmp(dec, plaintext, key_len);
2315    if (n_diff) {
2316        pr_err("error: decrypt doesn't match plain: %d\n", n_diff);
2317        goto test_rsa_end;
2318    }
2319
2320    /* wolfcrypt public encrypt */
2321    enc_ret = wc_RsaDirect(dec, key_len, enc, &out_len, key,
2322                           RSA_PUBLIC_ENCRYPT, &rng);
2323
2324    if (enc_ret != (int) key_len || key_len != out_len) {
2325        pr_err("error: rsa pub enc returned: %d, %d\n", enc_ret, out_len);
2326        ret = -1;
2327        goto test_rsa_end;
2328    }
2329
2330    ret = crypto_akcipher_set_priv_key(tfm, priv, priv_len);
2331    if (ret) {
2332        pr_err("error: crypto_akcipher_set_priv_key returned: %d\n", ret);
2333        goto test_rsa_end;
2334    }
2335
2336    {
2337        unsigned int maxsize = crypto_akcipher_maxsize(tfm);
2338        if (maxsize != key_len) {
2339            pr_err("error: crypto_akcipher_maxsize "
2340                   "returned %d, expected %d\n", maxsize, key_len);
2341            goto test_rsa_end;
2342        }
2343    }
2344
2345    /* kernel module decrypt with rsa private key */
2346    sg_init_one(&src, enc, key_len);
2347    sg_init_one(&dst, dec, key_len);
2348
2349    akcipher_request_set_crypt(req, &src, &dst, key_len, key_len);
2350
2351    memset(dec, 0, key_len);
2352    ret = crypto_akcipher_decrypt(req);
2353   #if defined(RHEL_RELEASE_CODE) && \
2354              (RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(9, 6))
2355    if (ret == -ENOSYS) {
2356        pr_info("info: ignoring failure from crypto_akcipher_decrypt (disabled by RHEL policy)\n");
2357        test_rc = 0;
2358        goto test_rsa_end;
2359    }
2360    #endif
2361    if (ret) {
2362        pr_err("error: crypto_akcipher_decrypt returned: %d\n", ret);
2363        goto test_rsa_end;
2364    }
2365
2366    n_diff = memcmp(dec, plaintext, key_len);
2367    if (n_diff) {
2368        pr_err("error: decrypt doesn't match plain: %d\n", n_diff);
2369        goto test_rsa_end;
2370    }
2371
2372    test_rc = 0;
2373
2374test_rsa_end:
2375    if (req) { akcipher_request_free(req); req = NULL; }
2376    if (tfm) { crypto_free_akcipher(tfm); tfm = NULL; }
2377
2378    if (pub) { free(pub); pub = NULL; }
2379    if (priv) { free(priv); priv = NULL; }
2380
2381    if (plaintext) { free(plaintext); plaintext = NULL; }
2382    if (dec) { free(dec); dec = NULL; }
2383    if (enc) { free(enc); enc = NULL; }
2384
2385    if (init_key) { wc_FreeRsaKey(key); init_key = 0; }
2386    if (init_rng) { wc_FreeRng(&rng); init_rng = 0; }
2387
2388    if (key) { free(key); key = NULL; }
2389
2390    #ifdef WOLFKM_DEBUG_RSA
2391    pr_info("info: %s, %d, %d: self test returned: %d\n", driver,
2392            nbits, key_len, ret);
2393    #endif /* WOLFKM_DEBUG_RSA */
2394
2395    return test_rc;
2396}
2397#endif /* LINUXKM_DIRECT_RSA */
2398
2399#if (!defined(NO_SHA256) || defined(WOLFSSL_SHA512)) && \
2400    defined(WOLFSSL_KEY_GEN)
2401/* Test pkcs1pad akcipher.
2402 *
2403 *
2404 * */
2405static int linuxkm_test_pkcs1pad_driver(const char * driver, int nbits,
2406                                        int hash_oid, word32 hash_len,
2407                                        uint8_t optional)
2408{
2409    int                       test_rc = WC_NO_ERR_TRACE(WC_FAILURE);
2410    int                       ret = 0;
2411    struct crypto_akcipher *  tfm = NULL;
2412    struct akcipher_request * req = NULL;
2413    RsaKey *                  key = NULL;
2414    WC_RNG                    rng;
2415    byte *                    priv = NULL; /* priv der */
2416    word32                    priv_len = 0;
2417    byte *                    pub = NULL; /* pub der */
2418    word32                    pub_len = 0;
2419    byte                      init_rng = 0;
2420    byte                      init_key = 0;
2421    static const byte         p_vector[] =
2422    /* Now is the time for all good men w/o trailing 0 */
2423    {
2424        0x4e,0x6f,0x77,0x20,0x69,0x73,0x20,0x74,
2425        0x68,0x65,0x20,0x74,0x69,0x6d,0x65,0x20,
2426        0x66,0x6f,0x72,0x20,0x61,0x6c,0x6c,0x20,
2427        0x67,0x6f,0x6f,0x64,0x20,0x6d,0x65,0x6e
2428    };
2429    #if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
2430    byte *                    hash = NULL;
2431    byte *                    sig = NULL;
2432    byte *                    km_sig = NULL;
2433    #endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
2434    byte *                    dec = NULL;
2435    byte *                    enc = NULL;
2436    byte *                    dec2 = NULL;
2437    byte *                    enc2 = NULL;
2438    word32                    key_len = 0;
2439    #if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
2440    word32                    sig_len = 0;
2441    word32                    enc_len = 0;
2442    #endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
2443    struct scatterlist        src, dst;
2444    #if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
2445    struct scatterlist        src_tab[2];
2446    #endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
2447    int                       n_diff = 0;
2448    uint8_t                   skipped = 0;
2449
2450    #ifdef LINUXKM_AKCIPHER_NO_SIGNVERIFY
2451    (void)hash_oid;
2452    (void)hash_len;
2453    #endif
2454
2455    #if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
2456    hash = malloc(hash_len);
2457    if (! hash) {
2458        pr_err("error: allocating hash buffer failed.\n");
2459        test_rc = MEMORY_E;
2460        goto test_pkcs1_end;
2461    }
2462
2463    memset(hash, 0, hash_len);
2464
2465    /* hash the test msg with hash algo. */
2466    ret = wc_Hash(wc_OidGetHash(hash_oid), p_vector, sizeof(p_vector),
2467                  hash, hash_len);
2468    if (ret) {
2469        pr_err("error: wc_Hash returned: %d\n", ret);
2470        test_rc = ret;
2471        goto test_pkcs1_end;
2472    }
2473    #endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
2474
2475    key = (RsaKey*)malloc(sizeof(RsaKey));
2476    if (key == NULL) {
2477        pr_err("error: allocating key(%zu) failed\n", sizeof(RsaKey));
2478        test_rc = MEMORY_E;
2479        goto test_pkcs1_end;
2480    }
2481
2482    memset(&rng, 0, sizeof(rng));
2483    memset(key, 0, sizeof(RsaKey));
2484
2485    ret = LKCAPI_INITRNG(&rng);
2486    if (ret) {
2487        pr_err("error: init rng returned: %d\n", ret);
2488        goto test_pkcs1_end;
2489    }
2490    init_rng = 1;
2491
2492    ret = wc_InitRsaKey(key, NULL);
2493    if (ret) {
2494        pr_err("error: init rsa key returned: %d\n", ret);
2495        test_rc = ret;
2496        goto test_pkcs1_end;
2497    }
2498    init_key = 1;
2499
2500    ret = wc_RsaSetRNG(key, &rng);
2501    if (ret) {
2502        pr_err("error: rsa set rng returned: %d\n", ret);
2503        test_rc = ret;
2504        goto test_pkcs1_end;
2505    }
2506
2507    #ifdef HAVE_FIPS
2508    for (;;) {
2509    #endif
2510        ret = wc_MakeRsaKey(key, nbits, WC_RSA_EXPONENT, &rng);
2511    #ifdef HAVE_FIPS
2512        /* Retry if not prime. */
2513        if (ret == WC_NO_ERR_TRACE(PRIME_GEN_E)) {
2514            continue;
2515        }
2516        break;
2517    }
2518    #endif
2519
2520    if (ret) {
2521        pr_err("error: make rsa key returned: %d\n", ret);
2522        test_rc = ret;
2523        goto test_pkcs1_end;
2524    }
2525
2526    key_len = wc_RsaEncryptSize(key);
2527    if (key_len <= 0) {
2528        pr_err("error: rsa encrypt size returned: %d\n", key_len);
2529        test_rc = key_len;
2530        goto test_pkcs1_end;
2531    }
2532
2533    #if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
2534    sig = (byte*)malloc(key_len);
2535    if (sig == NULL) {
2536        pr_err("error: allocating sig(%d) failed\n", key_len);
2537        test_rc = MEMORY_E;
2538        goto test_pkcs1_end;
2539    }
2540    memset(sig, 0, key_len);
2541
2542    km_sig = (byte*)malloc(key_len);
2543    if (km_sig == NULL) {
2544        pr_err("error: allocating km_sig(%d) failed\n", key_len);
2545        test_rc = MEMORY_E;
2546        goto test_pkcs1_end;
2547    }
2548    memset(km_sig, 0, key_len);
2549    #endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
2550
2551    enc = (byte*)malloc(key_len);
2552    if (enc == NULL) {
2553        pr_err("error: allocating enc(%d) failed\n", key_len);
2554        test_rc = MEMORY_E;
2555        goto test_pkcs1_end;
2556    }
2557    memset(enc, 0, key_len);
2558
2559    dec = (byte*)malloc(key_len + 1);
2560    if (dec == NULL) {
2561        pr_err("error: allocating dec(%d) failed\n", key_len);
2562        test_rc = MEMORY_E;
2563        goto test_pkcs1_end;
2564    }
2565    memset(dec, 0, key_len + 1);
2566
2567    enc2 = (byte*)malloc(key_len);
2568    if (enc2 == NULL) {
2569        pr_err("error: allocating enc2(%d) failed\n", key_len);
2570        test_rc = MEMORY_E;
2571        goto test_pkcs1_end;
2572    }
2573    memset(enc2, 0, key_len);
2574
2575    dec2 = (byte*)malloc(key_len + 1);
2576    if (dec2 == NULL) {
2577        pr_err("error: allocating dec2(%d) failed\n", key_len);
2578        test_rc = MEMORY_E;
2579        goto test_pkcs1_end;
2580    }
2581    memset(dec2, 0, key_len + 1);
2582
2583    /**
2584     * Now export Rsa Der to pub and priv.
2585     * */
2586    priv_len = wc_RsaKeyToDer(key, NULL, 0);
2587    if (priv_len <= 0) {
2588        pr_err("error: rsa priv to der returned: %d\n", priv_len);
2589        test_rc = priv_len;
2590        goto test_pkcs1_end;
2591    }
2592
2593    priv = (byte*)malloc(priv_len);
2594    if (priv == NULL) {
2595        pr_err("error: allocating priv(%d) failed\n", priv_len);
2596        test_rc = MEMORY_E;
2597        goto test_pkcs1_end;
2598    }
2599
2600    memset(priv, 0, priv_len);
2601
2602    priv_len = wc_RsaKeyToDer(key, priv, priv_len);
2603    if (priv_len <= 0) {
2604        pr_err("error: rsa priv to der returned: %d\n", priv_len);
2605        test_rc = priv_len;
2606        goto test_pkcs1_end;
2607    }
2608
2609    /* get rsa pub der */
2610    pub_len = wc_RsaKeyToPublicDer(key, NULL, 0);
2611    if (pub_len <= 0) {
2612        pr_err("error: rsa pub to der returned: %d\n", pub_len);
2613        test_rc = pub_len;
2614        goto test_pkcs1_end;
2615    }
2616
2617    pub = (byte*)malloc(pub_len);
2618    if (pub == NULL) {
2619        pr_err("error: allocating pub(%d) failed\n", pub_len);
2620        test_rc = MEMORY_E;
2621        goto test_pkcs1_end;
2622    }
2623
2624    memset(pub, 0, pub_len);
2625
2626    pub_len = wc_RsaKeyToPublicDer(key, pub, pub_len);
2627    if (pub_len <= 0) {
2628        pr_err("error: rsa pub to der returned: %d\n", pub_len);
2629        test_rc = pub_len;
2630        goto test_pkcs1_end;
2631    }
2632
2633    #if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
2634    /**
2635     * Sanity test: first sign and verify with direct wolfcrypt API.
2636     * */
2637
2638    /* encode the hash. */
2639    enc_len = wc_EncodeSignature(enc, hash, hash_len, hash_oid);
2640    if (enc_len <= 0) {
2641        pr_err("error: wc_EncodeSignature returned: %d\n", enc_len);
2642        test_rc = enc_len;
2643        goto test_pkcs1_end;
2644    }
2645
2646    sig_len = wc_RsaSSL_Sign(enc, enc_len, sig, key_len, key, &rng);
2647    if (sig_len <= 0) {
2648        pr_err("error: wc_RsaSSL_Sign returned: %d\n", sig_len);
2649        test_rc = sig_len;
2650        goto test_pkcs1_end;
2651    }
2652
2653    memset(dec, 0, key_len + 1);
2654    ret = wc_RsaSSL_Verify(sig, key_len, dec, enc_len, key);
2655    if (ret <= 0 || ret != (int) enc_len) {
2656        pr_err("error: wc_RsaSSL_Verify returned %d, expected %d\n" , ret,
2657               enc_len);
2658        test_rc = ret;
2659        goto test_pkcs1_end;
2660    }
2661
2662    /* dec and enc should match now. */
2663    n_diff = memcmp(dec, enc, enc_len);
2664    if (n_diff) {
2665        pr_err("error: decrypt doesn't match plain: %d\n", n_diff);
2666        test_rc = BAD_FUNC_ARG;
2667        goto test_pkcs1_end;
2668    }
2669    #endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
2670
2671    /**
2672     * Allocate the akcipher transform, and set up
2673     * the akcipher request.
2674     * */
2675    tfm = crypto_alloc_akcipher(driver, 0, 0);
2676    if (IS_ERR(tfm)) {
2677        if (optional) {
2678            /* this cipher may not be available to test, skip. */
2679            skipped = 1;
2680        }
2681        else {
2682            pr_err("error: allocating akcipher algorithm %s failed: %ld\n",
2683                   driver, PTR_ERR(tfm));
2684            if (PTR_ERR(tfm) == -ENOMEM) {
2685                test_rc = MEMORY_E;
2686            }
2687            else {
2688                test_rc = BAD_FUNC_ARG;
2689            }
2690        }
2691        tfm = NULL;
2692        goto test_pkcs1_end;
2693    }
2694
2695    req = akcipher_request_alloc(tfm, GFP_KERNEL);
2696    if (IS_ERR(req)) {
2697        pr_err("error: allocating akcipher request %s failed\n",
2698               driver);
2699        if (PTR_ERR(req) == -ENOMEM)
2700            test_rc = MEMORY_E;
2701        else
2702            test_rc = BAD_FUNC_ARG;
2703        req = NULL;
2704        goto test_pkcs1_end;
2705    }
2706
2707    #if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
2708    /**
2709     * pkcs1 sign and verify test
2710     * */
2711    ret = crypto_akcipher_set_priv_key(tfm, priv, priv_len);
2712    if (ret) {
2713        pr_err("error: crypto_akcipher_set_priv_key returned: %d\n", ret);
2714        test_rc = BAD_FUNC_ARG;
2715        goto test_pkcs1_end;
2716    }
2717
2718    {
2719        unsigned int maxsize = crypto_akcipher_maxsize(tfm);
2720        if (maxsize != key_len) {
2721            pr_err("error: crypto_akcipher_maxsize "
2722                   "returned %d, expected %d\n", maxsize, key_len);
2723            test_rc = BAD_FUNC_ARG;
2724            goto test_pkcs1_end;
2725        }
2726    }
2727
2728    sg_init_one(&src, hash, hash_len);
2729    sg_init_one(&dst, km_sig, key_len);
2730    memset(km_sig, 0, key_len);
2731
2732    akcipher_request_set_crypt(req, &src, &dst, hash_len, key_len);
2733
2734    ret = crypto_akcipher_sign(req);
2735    #if defined(RHEL_RELEASE_CODE) && \
2736               (RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(9, 6))
2737    if (ret == -ENOSYS) {
2738        pr_info("info: ignoring failure from crypto_akcipher_sign (disabled by RHEL policy)\n");
2739        test_rc = 0;
2740        goto test_pkcs1_end;
2741    }
2742    #endif
2743    if (ret) {
2744        pr_err("error: crypto_akcipher_sign returned: %d\n", ret);
2745        test_rc = BAD_FUNC_ARG;
2746        goto test_pkcs1_end;
2747    }
2748
2749    /* now set pub key for verify test. */
2750    ret = crypto_akcipher_set_pub_key(tfm, pub + 24, pub_len - 24);
2751    if (ret) {
2752        pr_err("error: crypto_akcipher_set_pub_key returned: %d\n", ret);
2753        test_rc = BAD_FUNC_ARG;
2754        goto test_pkcs1_end;
2755    }
2756
2757    {
2758        unsigned int maxsize = crypto_akcipher_maxsize(tfm);
2759        if (maxsize != key_len) {
2760            pr_err("error: crypto_akcipher_maxsize "
2761                   "returned %d, expected %d\n", maxsize, key_len);
2762            test_rc = BAD_FUNC_ARG;
2763            goto test_pkcs1_end;
2764        }
2765    }
2766
2767    /*
2768     * Set sig as src, and null as dst.
2769     * src_tab is:
2770     *   src_tab[0]: signature
2771     *   src_tab[1]: message (digest)
2772     *
2773     * src_len is sig size plus digest size.
2774     */
2775    sg_init_table(src_tab, 2);
2776    sg_set_buf(&src_tab[0], km_sig, key_len);
2777    sg_set_buf(&src_tab[1], hash, hash_len);
2778
2779    akcipher_request_set_crypt(req, src_tab, NULL, key_len,
2780                               hash_len);
2781
2782    ret = crypto_akcipher_verify(req);
2783    if (ret) {
2784        pr_err("error: crypto_akcipher_verify returned: %d\n", ret);
2785        test_rc = BAD_FUNC_ARG;
2786        goto test_pkcs1_end;
2787    }
2788
2789    memset(dec, 0, key_len + 1);
2790    ret = wc_RsaSSL_Verify(km_sig, key_len, dec, key_len, key);
2791    if (ret <= 0) {
2792        pr_err("error: wc_RsaSSL_Verify returned: %d\n", ret);
2793        test_rc = ret;
2794        goto test_pkcs1_end;
2795    }
2796
2797    n_diff = memcmp(km_sig, sig, sig_len);
2798    if (n_diff) {
2799        pr_err("error: km-sig doesn't match sig: %d\n", n_diff);
2800        test_rc = BAD_FUNC_ARG;
2801        goto test_pkcs1_end;
2802    }
2803
2804    /* dec and enc should match now. */
2805    n_diff = memcmp(dec, enc, enc_len);
2806    if (n_diff) {
2807        pr_err("error: decrypt doesn't match plain: %d\n", n_diff);
2808        test_rc = BAD_FUNC_ARG;
2809        goto test_pkcs1_end;
2810    }
2811    #endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
2812
2813    /*
2814     * pkcs1 encrypt and ecrypt test
2815     */
2816    memset(enc, 0, key_len);
2817    memset(enc2, 0, key_len);
2818    memset(dec, 0, key_len);
2819    memset(dec2, 0, key_len);
2820
2821    memcpy(dec, p_vector, sizeof(p_vector));
2822    memcpy(dec2, p_vector, sizeof(p_vector));
2823
2824    sg_init_one(&src, dec, sizeof(p_vector));
2825    sg_init_one(&dst, enc, key_len);
2826
2827    akcipher_request_set_crypt(req, &src, &dst, sizeof(p_vector), key_len);
2828
2829    /* now set pub key for verify test. */
2830    ret = crypto_akcipher_set_pub_key(tfm, pub + 24, pub_len - 24);
2831    if (ret) {
2832        pr_err("error: crypto_akcipher_set_pub_key returned: %d\n", ret);
2833        test_rc = BAD_FUNC_ARG;
2834        goto test_pkcs1_end;
2835    }
2836
2837    ret = crypto_akcipher_encrypt(req);
2838    if (ret) {
2839        pr_err("error: crypto_akcipher_encrypt returned: %d\n", ret);
2840        test_rc = BAD_FUNC_ARG;
2841        goto test_pkcs1_end;
2842    }
2843
2844    ret = wc_RsaPublicEncrypt(dec2, sizeof(p_vector), enc2,
2845                              key_len, key, &rng);
2846
2847    if (unlikely(ret != (int) key_len)) {
2848        pr_err("error: wc_RsaPublicEncrypt returned: %d\n", ret);
2849        test_rc = ret;
2850        goto test_pkcs1_end;
2851    }
2852
2853    memset(dec, 0, key_len);
2854    memset(dec2, 0, key_len);
2855
2856    sg_init_one(&src, enc, key_len);
2857    sg_init_one(&dst, dec, sizeof(p_vector));
2858
2859    akcipher_request_set_crypt(req, &src, &dst, key_len, sizeof(p_vector));
2860
2861    ret = crypto_akcipher_set_priv_key(tfm, priv, priv_len);
2862    if (ret) {
2863        pr_err("error: crypto_akcipher_set_priv_key returned: %d\n", ret);
2864        test_rc = BAD_FUNC_ARG;
2865        goto test_pkcs1_end;
2866    }
2867
2868    ret = crypto_akcipher_decrypt(req);
2869    #if defined(RHEL_RELEASE_CODE) && \
2870               (RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(9, 6))
2871    if (ret == -ENOSYS) {
2872        pr_info("info: ignoring failure from crypto_akcipher_decrypt (disabled by RHEL policy)\n");
2873        test_rc = 0;
2874        goto test_pkcs1_end;
2875    }
2876    #endif
2877    if (ret) {
2878        pr_err("error: crypto_akcipher_decrypt returned: %d\n", ret);
2879        test_rc = BAD_FUNC_ARG;
2880        goto test_pkcs1_end;
2881    }
2882
2883    ret = wc_RsaPrivateDecrypt(enc2, key_len, dec2,
2884                               sizeof(p_vector), key);
2885    if (ret != (int) sizeof(p_vector)) {
2886        pr_err("error: wc_RsaPrivateDecrypt returned: %d\n", ret);
2887        test_rc = ret;
2888        goto test_pkcs1_end;
2889    }
2890
2891    n_diff = memcmp(dec, dec2, sizeof(p_vector));
2892    if (n_diff) {
2893        pr_err("error: decrypt don't match: %d\n", n_diff);
2894        test_rc = BAD_FUNC_ARG;
2895        goto test_pkcs1_end;
2896    }
2897
2898    n_diff = memcmp(dec, p_vector, sizeof(p_vector));
2899    if (n_diff) {
2900        pr_err("error: decrypt doesn't match plaintext: %d\n", n_diff);
2901        test_rc = BAD_FUNC_ARG;
2902        goto test_pkcs1_end;
2903    }
2904
2905    test_rc = 0;
2906test_pkcs1_end:
2907    if (req) { akcipher_request_free(req); req = NULL; }
2908    if (tfm) { crypto_free_akcipher(tfm); tfm = NULL; }
2909
2910    if (priv) { free(priv); priv = NULL; }
2911    if (pub) { free(pub); pub = NULL; }
2912
2913    if (enc2) { free(enc2); enc2 = NULL; }
2914    if (dec2) { free(dec2); dec2 = NULL; }
2915    if (enc) { free(enc); enc = NULL; }
2916    if (dec) { free(dec); dec = NULL; }
2917
2918    #if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
2919    if (km_sig) { free(km_sig); km_sig = NULL; }
2920    if (sig) { free(sig); sig = NULL; }
2921    if (hash) { free(hash); }
2922    #endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
2923
2924    if (init_rng) { wc_FreeRng(&rng); init_rng = 0; }
2925    if (init_key) { wc_FreeRsaKey(key); init_key = 0; }
2926    if (key) { free(key); key = NULL; }
2927
2928    #ifdef WOLFKM_DEBUG_RSA
2929    if (skipped) {
2930        pr_info("info: %s, %d, %d: self test skipped\n", driver,
2931                nbits, key_len);
2932        test_rc = 0;
2933    }
2934    else {
2935        pr_info("info: %s, %d, %d: self test returned: %d\n", driver,
2936                nbits, key_len, ret);
2937    }
2938    #else /* !WOLFKM_DEBUG_RSA */
2939    (void)skipped;
2940    #endif /* !WOLFKM_DEBUG_RSA */
2941
2942    return test_rc;
2943}
2944
2945#if defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
2946/* Test the new pkcs1(<rsa>, <hash>) sig_alg driver for linux >= 6.13
2947 *
2948 * */
2949static int linuxkm_test_pkcs1_driver(const char * driver, int nbits,
2950                                     int hash_oid, word32 hash_len,
2951                                     uint8_t optional)
2952{
2953    int                  test_rc = WC_NO_ERR_TRACE(WC_FAILURE);
2954    int                  ret = 0;
2955    struct crypto_sig *  tfm = NULL;
2956    RsaKey *             key = NULL;
2957    WC_RNG               rng;
2958    byte *               priv = NULL; /* priv der */
2959    word32               priv_len = 0;
2960    byte *               pub = NULL; /* pub der */
2961    word32               pub_len = 0;
2962    byte                 init_rng = 0;
2963    byte                 init_key = 0;
2964    static const byte    p_vector[] =
2965    /* Now is the time for all good men w/o trailing 0 */
2966    {
2967        0x4e,0x6f,0x77,0x20,0x69,0x73,0x20,0x74,
2968        0x68,0x65,0x20,0x74,0x69,0x6d,0x65,0x20,
2969        0x66,0x6f,0x72,0x20,0x61,0x6c,0x6c,0x20,
2970        0x67,0x6f,0x6f,0x64,0x20,0x6d,0x65,0x6e
2971    };
2972    byte *               hash = NULL;
2973    byte *               sig = NULL;
2974    byte *               km_sig = NULL;
2975    byte *               dec = NULL;
2976    byte *               enc = NULL;
2977    word32               key_len = 0;
2978    word32               sig_len = 0;
2979    word32               enc_len = 0;
2980    int                  n_diff = 0;
2981    uint8_t              skipped = 0;
2982
2983    hash = malloc(hash_len);
2984    if (! hash) {
2985        pr_err("error: allocating hash buffer failed.\n");
2986        test_rc = MEMORY_E;
2987        goto test_pkcs1_end;
2988    }
2989
2990    memset(hash, 0, hash_len);
2991
2992    /* hash the test msg with hash algo. */
2993    ret = wc_Hash(wc_OidGetHash(hash_oid), p_vector, sizeof(p_vector),
2994                  hash, hash_len);
2995    if (ret) {
2996        pr_err("error: wc_Hash returned: %d\n", ret);
2997        test_rc = ret;
2998        goto test_pkcs1_end;
2999    }
3000
3001    key = (RsaKey*)malloc(sizeof(RsaKey));
3002    if (key == NULL) {
3003        pr_err("error: allocating key(%zu) failed\n", sizeof(RsaKey));
3004        test_rc = MEMORY_E;
3005        goto test_pkcs1_end;
3006    }
3007
3008    memset(&rng, 0, sizeof(rng));
3009    memset(key, 0, sizeof(RsaKey));
3010
3011    ret = LKCAPI_INITRNG(&rng);
3012    if (ret) {
3013        pr_err("error: init rng returned: %d\n", ret);
3014        goto test_pkcs1_end;
3015    }
3016    init_rng = 1;
3017
3018    ret = wc_InitRsaKey(key, NULL);
3019    if (ret) {
3020        pr_err("error: init rsa key returned: %d\n", ret);
3021        test_rc = ret;
3022        goto test_pkcs1_end;
3023    }
3024    init_key = 1;
3025
3026    ret = wc_RsaSetRNG(key, &rng);
3027    if (ret) {
3028        pr_err("error: rsa set rng returned: %d\n", ret);
3029        test_rc = ret;
3030        goto test_pkcs1_end;
3031    }
3032
3033    #ifdef HAVE_FIPS
3034    for (;;) {
3035    #endif
3036        ret = wc_MakeRsaKey(key, nbits, WC_RSA_EXPONENT, &rng);
3037    #ifdef HAVE_FIPS
3038        /* Retry if not prime. */
3039        if (ret == WC_NO_ERR_TRACE(PRIME_GEN_E)) {
3040            continue;
3041        }
3042        break;
3043    }
3044    #endif
3045
3046    if (ret) {
3047        pr_err("error: make rsa key returned: %d\n", ret);
3048        test_rc = ret;
3049        goto test_pkcs1_end;
3050    }
3051
3052    key_len = wc_RsaEncryptSize(key);
3053    if (key_len <= 0) {
3054        pr_err("error: rsa encrypt size returned: %d\n", key_len);
3055        test_rc = key_len;
3056        goto test_pkcs1_end;
3057    }
3058
3059    sig = (byte*)malloc(key_len);
3060    if (sig == NULL) {
3061        pr_err("error: allocating sig(%d) failed\n", key_len);
3062        test_rc = MEMORY_E;
3063        goto test_pkcs1_end;
3064    }
3065    memset(sig, 0, key_len);
3066
3067    km_sig = (byte*)malloc(key_len);
3068    if (km_sig == NULL) {
3069        pr_err("error: allocating km_sig(%d) failed\n", key_len);
3070        test_rc = MEMORY_E;
3071        goto test_pkcs1_end;
3072    }
3073    memset(km_sig, 0, key_len);
3074
3075    /**
3076     * Now export Rsa Der to pub and priv.
3077     * */
3078    priv_len = wc_RsaKeyToDer(key, NULL, 0);
3079    if (priv_len <= 0) {
3080        pr_err("error: rsa priv to der returned: %d\n", priv_len);
3081        test_rc = priv_len;
3082        goto test_pkcs1_end;
3083    }
3084
3085    priv = (byte*)malloc(priv_len);
3086    if (priv == NULL) {
3087        pr_err("error: allocating priv(%d) failed\n", priv_len);
3088        test_rc = MEMORY_E;
3089        goto test_pkcs1_end;
3090    }
3091
3092    memset(priv, 0, priv_len);
3093
3094    priv_len = wc_RsaKeyToDer(key, priv, priv_len);
3095    if (priv_len <= 0) {
3096        pr_err("error: rsa priv to der returned: %d\n", priv_len);
3097        test_rc = priv_len;
3098        goto test_pkcs1_end;
3099    }
3100
3101    /* get rsa pub der */
3102    pub_len = wc_RsaKeyToPublicDer(key, NULL, 0);
3103    if (pub_len <= 0) {
3104        pr_err("error: rsa pub to der returned: %d\n", pub_len);
3105        test_rc = pub_len;
3106        goto test_pkcs1_end;
3107    }
3108
3109    pub = (byte*)malloc(pub_len);
3110    if (pub == NULL) {
3111        pr_err("error: allocating pub(%d) failed\n", pub_len);
3112        test_rc = MEMORY_E;
3113        goto test_pkcs1_end;
3114    }
3115
3116    memset(pub, 0, pub_len);
3117
3118    pub_len = wc_RsaKeyToPublicDer(key, pub, pub_len);
3119    if (pub_len <= 0) {
3120        pr_err("error: rsa pub to der returned: %d\n", pub_len);
3121        test_rc = pub_len;
3122        goto test_pkcs1_end;
3123    }
3124
3125    enc = (byte*)malloc(key_len);
3126    if (enc == NULL) {
3127        pr_err("error: allocating enc(%d) failed\n", key_len);
3128        test_rc = MEMORY_E;
3129        goto test_pkcs1_end;
3130    }
3131    memset(enc, 0, key_len);
3132
3133    dec = (byte*)malloc(key_len + 1);
3134    if (dec == NULL) {
3135        pr_err("error: allocating dec(%d) failed\n", key_len);
3136        test_rc = MEMORY_E;
3137        goto test_pkcs1_end;
3138    }
3139    memset(dec, 0, key_len + 1);
3140
3141    /**
3142     * Sanity test: first sign and verify with direct wolfcrypt API.
3143     * */
3144
3145    /* encode the hash. */
3146    enc_len = wc_EncodeSignature(enc, hash, hash_len, hash_oid);
3147    if (enc_len <= 0) {
3148        pr_err("error: wc_EncodeSignature returned: %d\n", enc_len);
3149        test_rc = enc_len;
3150        goto test_pkcs1_end;
3151    }
3152
3153    sig_len = wc_RsaSSL_Sign(enc, enc_len, sig, key_len, key, &rng);
3154    if (sig_len <= 0) {
3155        pr_err("error: wc_RsaSSL_Sign returned: %d\n", sig_len);
3156        test_rc = sig_len;
3157        goto test_pkcs1_end;
3158    }
3159
3160    memset(dec, 0, key_len + 1);
3161    ret = wc_RsaSSL_Verify(sig, key_len, dec, enc_len, key);
3162    if (ret <= 0 || ret != (int) enc_len) {
3163        pr_err("error: wc_RsaSSL_Verify returned %d, expected %d\n" , ret,
3164               enc_len);
3165        test_rc = ret;
3166        goto test_pkcs1_end;
3167    }
3168
3169    /* dec and enc should match now. */
3170    n_diff = memcmp(dec, enc, enc_len);
3171    if (n_diff) {
3172        pr_err("error: decrypt doesn't match plain: %d\n", n_diff);
3173        test_rc = BAD_FUNC_ARG;
3174        goto test_pkcs1_end;
3175    }
3176
3177    /*
3178     * Allocate the sig_alg transform
3179     * */
3180    tfm = crypto_alloc_sig(driver, 0, 0);
3181    if (IS_ERR(tfm)) {
3182        if (optional) {
3183            /* this cipher may not be available to test, skip. */
3184            skipped = 1;
3185        }
3186        else {
3187            pr_err("error: allocating sig algorithm %s failed: %ld\n",
3188                   driver, PTR_ERR(tfm));
3189            if (PTR_ERR(tfm) == -ENOMEM) {
3190                test_rc = MEMORY_E;
3191            }
3192            else {
3193                test_rc = BAD_FUNC_ARG;
3194            }
3195        }
3196        tfm = NULL;
3197        goto test_pkcs1_end;
3198    }
3199
3200    ret = crypto_sig_set_privkey(tfm, priv, priv_len);
3201    if (ret) {
3202        pr_err("error: crypto_sig_set_privkey returned: %d\n", ret);
3203        test_rc = BAD_FUNC_ARG;
3204        goto test_pkcs1_end;
3205    }
3206
3207    {
3208        /* The behavior of crypto_sig_Xsize (X= max, key, digest) changed
3209         * at linux kernel v6.15.3:
3210         *   <  6.15.3: all three should return the same value (in bytes).
3211         *   >= 6.15.3: keysize is in bits, maxsize and digestsize in bytes. */
3212        unsigned int maxsize = crypto_sig_maxsize(tfm);
3213        unsigned int keysize = crypto_sig_keysize(tfm);
3214        unsigned int digestsize = crypto_sig_digestsize(tfm);
3215
3216        #if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 3)
3217        keysize = ((keysize + WOLFSSL_BIT_SIZE - 1) / WOLFSSL_BIT_SIZE);
3218        #endif /* linux >= 6.15.3 */
3219
3220        #ifdef WOLFKM_DEBUG_RSA
3221        pr_info("info: crypto_sig_{max, key, digest}size: "
3222                "{%d, %d, %d}\n",
3223                 maxsize, keysize, digestsize);
3224        #endif /* WOLFKM_DEBUG_RSA */
3225
3226        if (maxsize != key_len ||
3227            keysize != key_len ||
3228            digestsize != key_len) {
3229            pr_err("error: crypto_sig_{max, key, digest}size "
3230                   "returned {%d, %d, %d}, expected %d\n",
3231                    maxsize, keysize, digestsize, key_len);
3232            test_rc = BAD_FUNC_ARG;
3233            goto test_pkcs1_end;
3234        }
3235    }
3236
3237    ret = crypto_sig_sign(tfm, hash, hash_len, km_sig, key_len);
3238    if (ret < 0) {
3239        pr_err("error: crypto_sig_sign returned: %d\n", ret);
3240        test_rc = BAD_FUNC_ARG;
3241        goto test_pkcs1_end;
3242    }
3243
3244    /* in 6.15 crypto_sig_sign switched from returning 0 on success to
3245     * returning sig_len. */
3246    #if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0)
3247    if ((word32) ret != sig_len) {
3248        pr_err("error: crypto_sig_sign returned %d, expected %d\n", ret,
3249               sig_len);
3250        test_rc = BAD_FUNC_ARG;
3251        goto test_pkcs1_end;
3252    }
3253    #endif /* linux >= 6.15.0 */
3254
3255    n_diff = memcmp(km_sig, sig, sig_len);
3256    if (n_diff) {
3257        pr_err("error: km-sig doesn't match sig: %d\n", n_diff);
3258        test_rc = BAD_FUNC_ARG;
3259        goto test_pkcs1_end;
3260    }
3261
3262    ret = crypto_sig_verify(tfm, sig, sig_len, hash, hash_len);
3263    if (ret) {
3264        pr_err("error: crypto_sig_verify returned: %d\n", ret);
3265        test_rc = BAD_FUNC_ARG;
3266        goto test_pkcs1_end;
3267    }
3268
3269    test_rc = 0;
3270test_pkcs1_end:
3271    if (tfm) { crypto_free_sig(tfm); tfm = NULL; }
3272
3273    if (priv) { free(priv); priv = NULL; }
3274    if (pub) { free(pub); pub = NULL; }
3275
3276    if (enc) { free(enc); enc = NULL; }
3277    if (dec) { free(dec); dec = NULL; }
3278
3279    if (km_sig) { free(km_sig); km_sig = NULL; }
3280    if (sig) { free(sig); sig = NULL; }
3281    if (hash) { free(hash); }
3282
3283    if (init_rng) { wc_FreeRng(&rng); init_rng = 0; }
3284    if (init_key) { wc_FreeRsaKey(key); init_key = 0; }
3285    if (key) { free(key); key = NULL; }
3286
3287    #ifdef WOLFKM_DEBUG_RSA
3288    if (skipped) {
3289        pr_info("info: %s, %d, %d: self test skipped\n", driver,
3290                nbits, key_len);
3291        test_rc = 0;
3292    }
3293    else {
3294        pr_info("info: %s, %d, %d: self test returned: %d\n", driver,
3295                nbits, key_len, ret);
3296    }
3297    #else /* !WOLFKM_DEBUG_RSA */
3298    (void)skipped;
3299    #endif /* !WOLFKM_DEBUG_RSA */
3300
3301    return test_rc;
3302}
3303#endif /* LINUXKM_AKCIPHER_NO_SIGNVERIFY */
3304#endif /* (!NO_SHA256 || WOLFSSL_SHA512) && WOLFSSL_KEY_GEN */
3305
3306/*
3307 * returns the additional encoding length for given hash oid.
3308 */
3309static int get_hash_enc_len(int hash_oid)
3310{
3311    int enc_len = -1;
3312
3313    switch (hash_oid) {
3314    case SHA224h:
3315    case SHA256h:
3316    case SHA384h:
3317    case SHA512h:
3318    case SHA3_256h:
3319    case SHA3_384h:
3320    case SHA3_512h:
3321        enc_len = 19;
3322        break;
3323    default:
3324        break;
3325    }
3326
3327    return enc_len;
3328}
3329#endif /* LINUXKM_LKCAPI_REGISTER_RSA */
3330
3331#endif /* !WC_SKIP_INCLUDED_C_FILES */