d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

crypto/openssl: add RSA and mod asym operations

Browse Source 
- Add compat.h to make pmd compatible to openssl-1.1.0 and
  backward version
- Add rsa sign/verify/encrypt/decrypt and modular operation
  support

Signed-off-by: Sunila Sahu <sunila.sahu@caviumnetworks.com>
Signed-off-by: Shally Verma <shally.verma@caviumnetworks.com>
Signed-off-by: Ashish Gupta <ashish.gupta@caviumnetworks.com>
This commit is contained in:
Sunila Sahu 2018-07-23 20:16:03 +05:30 committed by Pablo de Lara
parent 0baf92041e
commit 3e9d6bd447
4 changed files with 617 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
drivers/crypto/openssl/compat.h Normal file
View File

@ -0,0 +1,40 @@
/* SPDX-License-Identifier: BSD-3-Clause
* Copyright(c) 2018 Cavium Networks
*/
#ifndef __RTA_COMPAT_H__
#define __RTA_COMPAT_H__
#if (OPENSSL_VERSION_NUMBER < 0x10100000L)
#define set_rsa_params(rsa, p, q, ret) \
do {rsa->p = p; rsa->q = q; ret = 0; } while (0)
#define set_rsa_crt_params(rsa, dmp1, dmq1, iqmp, ret) \
do { \
rsa->dmp1 = dmp1; \
rsa->dmq1 = dmq1; \
rsa->iqmp = iqmp; \
ret = 0; \
} while (0)
#define set_rsa_keys(rsa, n, e, d, ret) \
do { \
rsa->n = n; rsa->e = e; rsa->d = d; ret = 0; \
} while (0)
#else
#define set_rsa_params(rsa, p, q, ret) \
(ret = !RSA_set0_factors(rsa, p, q))
#define set_rsa_crt_params(rsa, dmp1, dmq1, iqmp, ret) \
(ret = !RSA_set0_crt_params(rsa, dmp1, dmq1, iqmp))
/* n, e must be non-null, d can be NULL */
#define set_rsa_keys(rsa, n, e, d, ret) \
(ret = !RSA_set0_key(rsa, n, e, d))
#endif /* version < 10100000 */
#endif /* __RTA_COMPAT_H__ */

234
drivers/crypto/openssl/rte_openssl_pmd.c
View File

@ -14,6 +14,7 @@
#include <openssl/evp.h>
#include "rte_openssl_pmd_private.h"
#include "compat.h"
#define DES_BLOCK_SIZE 8
@ -730,19 +731,36 @@ openssl_reset_session(struct openssl_session *sess)
}
/** Provide session for operation */
static struct openssl_session *
static void *
get_session(struct openssl_qp *qp, struct rte_crypto_op *op)
{
struct openssl_session *sess = NULL;
struct openssl_asym_session *asym_sess = NULL;
if (op->sess_type == RTE_CRYPTO_OP_WITH_SESSION) {
/* get existing session */
if (likely(op->sym->session != NULL))
sess = (struct openssl_session *)
get_sym_session_private_data(
op->sym->session,
cryptodev_driver_id);
if (op->type == RTE_CRYPTO_OP_TYPE_SYMMETRIC) {
/* get existing session */
if (likely(op->sym->session != NULL))
sess = (struct openssl_session *)
get_sym_session_private_data(
op->sym->session,
cryptodev_driver_id);
} else {
if (likely(op->asym->session != NULL))
asym_sess = (struct openssl_asym_session *)
get_asym_session_private_data(
op->asym->session,
cryptodev_driver_id);
if (asym_sess == NULL)
op->status =
RTE_CRYPTO_OP_STATUS_INVALID_SESSION;
return asym_sess;
}
} else {
/* sessionless asymmetric not supported */
if (op->type == RTE_CRYPTO_OP_TYPE_ASYMMETRIC)
return NULL;
/* provide internal session */
void *_sess = NULL;
void *_sess_private_data = NULL;
@ -1528,6 +1546,196 @@ process_openssl_auth_op(struct openssl_qp *qp, struct rte_crypto_op *op,
op->status = RTE_CRYPTO_OP_STATUS_ERROR;
}
/* process modinv operation */
static int
process_openssl_modinv_op(struct rte_crypto_op *cop,
struct openssl_asym_session *sess)
{
struct rte_crypto_asym_op *op = cop->asym;
BIGNUM *base = BN_CTX_get(sess->u.m.ctx);
BIGNUM *res = BN_CTX_get(sess->u.m.ctx);
if (unlikely(base == NULL || res == NULL)) {
if (base)
BN_free(base);
if (res)
BN_free(res);
cop->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
return -1;
}
base = BN_bin2bn((const unsigned char *)op->modinv.base.data,
op->modinv.base.length, base);
if (BN_mod_inverse(res, base, sess->u.m.modulus, sess->u.m.ctx)) {
cop->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
op->modinv.base.length = BN_bn2bin(res, op->modinv.base.data);
} else {
cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
}
return 0;
}
/* process modexp operation */
static int
process_openssl_modexp_op(struct rte_crypto_op *cop,
struct openssl_asym_session *sess)
{
struct rte_crypto_asym_op *op = cop->asym;
BIGNUM *base = BN_CTX_get(sess->u.e.ctx);
BIGNUM *res = BN_CTX_get(sess->u.e.ctx);
if (unlikely(base == NULL || res == NULL)) {
if (base)
BN_free(base);
if (res)
BN_free(res);
cop->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
return -1;
}
base = BN_bin2bn((const unsigned char *)op->modinv.base.data,
op->modinv.base.length, base);
if (BN_mod_exp(res, base, sess->u.e.exp,
sess->u.e.mod, sess->u.e.ctx)) {
op->modinv.base.length = BN_bn2bin(res, op->modinv.base.data);
cop->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
} else {
cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
}
return 0;
}
/* process rsa operations */
static int
process_openssl_rsa_op(struct rte_crypto_op *cop,
struct openssl_asym_session *sess)
{
int ret = 0;
struct rte_crypto_asym_op *op = cop->asym;
RSA *rsa = sess->u.r.rsa;
uint32_t pad = (op->rsa.pad);
switch (pad) {
case RTE_CRYPTO_RSA_PKCS1_V1_5_BT0:
case RTE_CRYPTO_RSA_PKCS1_V1_5_BT1:
case RTE_CRYPTO_RSA_PKCS1_V1_5_BT2:
pad = RSA_PKCS1_PADDING;
break;
case RTE_CRYPTO_RSA_PADDING_NONE:
pad = RSA_NO_PADDING;
break;
default:
cop->status = RTE_CRYPTO_OP_STATUS_INVALID_ARGS;
OPENSSL_LOG(ERR,
"rsa pad type not supported %d\n", pad);
return 0;
}
switch (op->rsa.op_type) {
case RTE_CRYPTO_ASYM_OP_ENCRYPT:
ret = RSA_public_encrypt(op->rsa.message.length,
op->rsa.message.data,
op->rsa.message.data,
rsa,
pad);
if (ret > 0)
op->rsa.message.length = ret;
OPENSSL_LOG(DEBUG,
"length of encrypted text %d\n", ret);
break;
case RTE_CRYPTO_ASYM_OP_DECRYPT:
ret = RSA_private_decrypt(op->rsa.message.length,
op->rsa.message.data,
op->rsa.message.data,
rsa,
pad);
if (ret > 0)
op->rsa.message.length = ret;
break;
case RTE_CRYPTO_ASYM_OP_SIGN:
ret = RSA_private_encrypt(op->rsa.message.length,
op->rsa.message.data,
op->rsa.sign.data,
rsa,
pad);
if (ret > 0)
op->rsa.sign.length = ret;
break;
case RTE_CRYPTO_ASYM_OP_VERIFY:
ret = RSA_public_decrypt(op->rsa.sign.length,
op->rsa.sign.data,
op->rsa.sign.data,
rsa,
pad);
OPENSSL_LOG(DEBUG,
"Length of public_decrypt %d "
"length of message %zd\n",
ret, op->rsa.message.length);
if (memcmp(op->rsa.sign.data, op->rsa.message.data,
op->rsa.message.length)) {
OPENSSL_LOG(ERR,
"RSA sign Verification failed");
return -1;
}
break;
default:
/* allow ops with invalid args to be pushed to
* completion queue
*/
cop->status = RTE_CRYPTO_OP_STATUS_INVALID_ARGS;
break;
}
if (ret < 0)
cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
return 0;
}
static int
process_asym_op(struct openssl_qp *qp, struct rte_crypto_op *op,
struct openssl_asym_session *sess)
{
int retval = 0;
op->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
switch (sess->xfrm_type) {
case RTE_CRYPTO_ASYM_XFORM_RSA:
retval = process_openssl_rsa_op(op, sess);
break;
case RTE_CRYPTO_ASYM_XFORM_MODEX:
retval = process_openssl_modexp_op(op, sess);
break;
case RTE_CRYPTO_ASYM_XFORM_MODINV:
retval = process_openssl_modinv_op(op, sess);
break;
default:
op->status = RTE_CRYPTO_OP_STATUS_INVALID_ARGS;
break;
}
if (!retval) {
/* op processed so push to completion queue as processed */
retval = rte_ring_enqueue(qp->processed_ops, (void *)op);
if (retval)
/* return error if failed to put in completion queue */
retval = -1;
}
return retval;
}
/** Process crypto operation for mbuf */
static int
process_op(struct openssl_qp *qp, struct rte_crypto_op *op,
@ -1600,7 +1808,7 @@ static uint16_t
openssl_pmd_enqueue_burst(void *queue_pair, struct rte_crypto_op **ops,
uint16_t nb_ops)
{
struct openssl_session *sess;
void *sess;
struct openssl_qp *qp = queue_pair;
int i, retval;
@ -1609,7 +1817,12 @@ openssl_pmd_enqueue_burst(void *queue_pair, struct rte_crypto_op **ops,
if (unlikely(sess == NULL))
goto enqueue_err;
retval = process_op(qp, ops[i], sess);
if (ops[i]->type == RTE_CRYPTO_OP_TYPE_SYMMETRIC)
retval = process_op(qp, ops[i],
(struct openssl_session *) sess);
else
retval = process_asym_op(qp, ops[i],
(struct openssl_asym_session *) sess);
if (unlikely(retval < 0))
goto enqueue_err;
}
@ -1664,7 +1877,8 @@ cryptodev_openssl_create(const char *name,
RTE_CRYPTODEV_FF_SYM_OPERATION_CHAINING |
RTE_CRYPTODEV_FF_CPU_AESNI |
RTE_CRYPTODEV_FF_OOP_SGL_IN_LB_OUT |
RTE_CRYPTODEV_FF_OOP_LB_IN_LB_OUT;
RTE_CRYPTODEV_FF_OOP_LB_IN_LB_OUT |
RTE_CRYPTODEV_FF_ASYMMETRIC_CRYPTO;
/* Set vector instructions mode supported */
internals = dev->data->dev_private;

336
drivers/crypto/openssl/rte_openssl_pmd_ops.c
View File

@ -9,6 +9,7 @@
#include <rte_cryptodev_pmd.h>
#include "rte_openssl_pmd_private.h"
#include "compat.h"
static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
@ -469,6 +470,63 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
}, }
}, }
},
{ /* RSA */
.op = RTE_CRYPTO_OP_TYPE_ASYMMETRIC,
{.asym = {
.xform_capa = {
.xform_type = RTE_CRYPTO_ASYM_XFORM_RSA,
.op_types = ((1 << RTE_CRYPTO_ASYM_OP_SIGN) |
(1 << RTE_CRYPTO_ASYM_OP_VERIFY) |
(1 << RTE_CRYPTO_ASYM_OP_ENCRYPT) |
(1 << RTE_CRYPTO_ASYM_OP_DECRYPT)),
{
.modlen = {
/* min length is based on openssl rsa keygen */
.min = 30,
/* value 0 symbolizes no limit on max length */
.max = 0,
.increment = 1
}, }
}
},
}
},
{ /* modexp */
.op = RTE_CRYPTO_OP_TYPE_ASYMMETRIC,
{.asym = {
.xform_capa = {
.xform_type = RTE_CRYPTO_ASYM_XFORM_MODEX,
.op_types = 0,
{
.modlen = {
/* value 0 symbolizes no limit on min length */
.min = 0,
/* value 0 symbolizes no limit on max length */
.max = 0,
.increment = 1
}, }
}
},
}
},
{ /* modinv */
.op = RTE_CRYPTO_OP_TYPE_ASYMMETRIC,
{.asym = {
.xform_capa = {
.xform_type = RTE_CRYPTO_ASYM_XFORM_MODINV,
.op_types = 0,
{
.modlen = {
/* value 0 symbolizes no limit on min length */
.min = 0,
/* value 0 symbolizes no limit on max length */
.max = 0,
.increment = 1
}, }
}
},
}
},
RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
};
@ -655,13 +713,20 @@ openssl_pmd_qp_count(struct rte_cryptodev *dev)
return dev->data->nb_queue_pairs;
}
/** Returns the size of the session structure */
/** Returns the size of the symmetric session structure */
static unsigned
openssl_pmd_sym_session_get_size(struct rte_cryptodev *dev __rte_unused)
{
return sizeof(struct openssl_session);
}
/** Returns the size of the asymmetric session structure */
static unsigned
openssl_pmd_asym_session_get_size(struct rte_cryptodev *dev __rte_unused)
{
return sizeof(struct openssl_asym_session);
}
/** Configure the session from a crypto xform chain */
static int
openssl_pmd_sym_session_configure(struct rte_cryptodev *dev __rte_unused,
@ -698,6 +763,226 @@ openssl_pmd_sym_session_configure(struct rte_cryptodev *dev __rte_unused,
return 0;
}
static int openssl_set_asym_session_parameters(
struct openssl_asym_session *asym_session,
struct rte_crypto_asym_xform *xform)
{
int ret = 0;
if (xform->next != NULL) {
OPENSSL_LOG(ERR, "chained xfrms are not supported on %s",
rte_crypto_asym_xform_strings[xform->xform_type]);
return -1;
}
switch (xform->xform_type) {
case RTE_CRYPTO_ASYM_XFORM_RSA:
{
BIGNUM *n = NULL;
BIGNUM *e = NULL;
BIGNUM *d = NULL;
BIGNUM *p = NULL, *q = NULL, *dmp1 = NULL;
BIGNUM *iqmp = NULL, *dmq1 = NULL;
/* copy xfrm data into rsa struct */
n = BN_bin2bn((const unsigned char *)xform->rsa.n.data,
xform->rsa.n.length, n);
e = BN_bin2bn((const unsigned char *)xform->rsa.e.data,
xform->rsa.e.length, e);
if (!n || !e)
goto err_rsa;
RSA *rsa = RSA_new();
if (rsa == NULL)
goto err_rsa;
if (xform->rsa.key_type == RTE_RSA_KEY_TYPE_EXP) {
d = BN_bin2bn(
(const unsigned char *)xform->rsa.d.data,
xform->rsa.d.length,
d);
if (!d) {
RSA_free(rsa);
goto err_rsa;
}
} else {
p = BN_bin2bn((const unsigned char *)
xform->rsa.qt.p.data,
xform->rsa.qt.p.length,
p);
q = BN_bin2bn((const unsigned char *)
xform->rsa.qt.q.data,
xform->rsa.qt.q.length,
q);
dmp1 = BN_bin2bn((const unsigned char *)
xform->rsa.qt.dP.data,
xform->rsa.qt.dP.length,
dmp1);
dmq1 = BN_bin2bn((const unsigned char *)
xform->rsa.qt.dQ.data,
xform->rsa.qt.dQ.length,
dmq1);
iqmp = BN_bin2bn((const unsigned char *)
xform->rsa.qt.qInv.data,
xform->rsa.qt.qInv.length,
iqmp);
if (!p || !q || !dmp1 || !dmq1 || !iqmp) {
RSA_free(rsa);
goto err_rsa;
}
set_rsa_params(rsa, p, q, ret);
if (ret) {
OPENSSL_LOG(ERR,
"failed to set rsa params\n");
RSA_free(rsa);
goto err_rsa;
}
set_rsa_crt_params(rsa, dmp1, dmq1, iqmp, ret);
if (ret) {
OPENSSL_LOG(ERR,
"failed to set crt params\n");
RSA_free(rsa);
/*
* set already populated params to NULL
* as its freed by call to RSA_free
*/
p = q = NULL;
goto err_rsa;
}
}
set_rsa_keys(rsa, n, e, d, ret);
if (ret) {
OPENSSL_LOG(ERR, "Failed to load rsa keys\n");
RSA_free(rsa);
return -1;
}
asym_session->u.r.rsa = rsa;
asym_session->xfrm_type = RTE_CRYPTO_ASYM_XFORM_RSA;
break;
err_rsa:
if (n)
BN_free(n);
if (e)
BN_free(e);
if (d)
BN_free(d);
if (p)
BN_free(p);
if (q)
BN_free(q);
if (dmp1)
BN_free(dmp1);
if (dmq1)
BN_free(dmq1);
if (iqmp)
BN_free(iqmp);
return -1;
}
case RTE_CRYPTO_ASYM_XFORM_MODEX:
{
struct rte_crypto_modex_xform *xfrm = &(xform->modex);
BN_CTX *ctx = BN_CTX_new();
if (ctx == NULL) {
OPENSSL_LOG(ERR,
" failed to allocate resources\n");
return -1;
}
BN_CTX_start(ctx);
BIGNUM *mod = BN_CTX_get(ctx);
BIGNUM *exp = BN_CTX_get(ctx);
if (mod == NULL || exp == NULL) {
BN_CTX_end(ctx);
BN_CTX_free(ctx);
return -1;
}
mod = BN_bin2bn((const unsigned char *)
xfrm->modulus.data,
xfrm->modulus.length, mod);
exp = BN_bin2bn((const unsigned char *)
xfrm->exponent.data,
xfrm->exponent.length, exp);
asym_session->u.e.ctx = ctx;
asym_session->u.e.mod = mod;
asym_session->u.e.exp = exp;
asym_session->xfrm_type = RTE_CRYPTO_ASYM_XFORM_MODEX;
break;
}
case RTE_CRYPTO_ASYM_XFORM_MODINV:
{
struct rte_crypto_modinv_xform *xfrm = &(xform->modinv);
BN_CTX *ctx = BN_CTX_new();
if (ctx == NULL) {
OPENSSL_LOG(ERR,
" failed to allocate resources\n");
return -1;
}
BN_CTX_start(ctx);
BIGNUM *mod = BN_CTX_get(ctx);
if (mod == NULL) {
BN_CTX_end(ctx);
BN_CTX_free(ctx);
return -1;
}
mod = BN_bin2bn((const unsigned char *)
xfrm->modulus.data,
xfrm->modulus.length,
mod);
asym_session->u.m.ctx = ctx;
asym_session->u.m.modulus = mod;
asym_session->xfrm_type = RTE_CRYPTO_ASYM_XFORM_MODINV;
break;
}
default:
return -1;
}
return 0;
}
/** Configure the session from a crypto xform chain */
static int
openssl_pmd_asym_session_configure(struct rte_cryptodev *dev __rte_unused,
struct rte_crypto_asym_xform *xform,
struct rte_cryptodev_asym_session *sess,
struct rte_mempool *mempool)
{
void *asym_sess_private_data;
int ret;
if (unlikely(sess == NULL)) {
OPENSSL_LOG(ERR, "invalid asymmetric session struct");
return -EINVAL;
}
if (rte_mempool_get(mempool, &asym_sess_private_data)) {
CDEV_LOG_ERR(
"Couldn't get object from session mempool");
return -ENOMEM;
}
ret = openssl_set_asym_session_parameters(asym_sess_private_data,
xform);
if (ret != 0) {
OPENSSL_LOG(ERR, "failed configure session parameters");
/* Return session to mempool */
rte_mempool_put(mempool, asym_sess_private_data);
return ret;
}
set_asym_session_private_data(sess, dev->driver_id,
asym_sess_private_data);
return 0;
}
/** Clear the memory of session so it doesn't leave key material behind */
static void
@ -717,6 +1002,50 @@ openssl_pmd_sym_session_clear(struct rte_cryptodev *dev,
}
}
static void openssl_reset_asym_session(struct openssl_asym_session *sess)
{
switch (sess->xfrm_type) {
case RTE_CRYPTO_ASYM_XFORM_RSA:
if (sess->u.r.rsa)
RSA_free(sess->u.r.rsa);
break;
case RTE_CRYPTO_ASYM_XFORM_MODEX:
if (sess->u.e.ctx) {
BN_CTX_end(sess->u.e.ctx);
BN_CTX_free(sess->u.e.ctx);
}
break;
case RTE_CRYPTO_ASYM_XFORM_MODINV:
if (sess->u.m.ctx) {
BN_CTX_end(sess->u.m.ctx);
BN_CTX_free(sess->u.m.ctx);
}
break;
default:
break;
}
}
/** Clear the memory of asymmetric session
* so it doesn't leave key material behind
*/
static void
openssl_pmd_asym_session_clear(struct rte_cryptodev *dev,
struct rte_cryptodev_asym_session *sess)
{
uint8_t index = dev->driver_id;
void *sess_priv = get_asym_session_private_data(sess, index);
/* Zero out the whole structure */
if (sess_priv) {
openssl_reset_asym_session(sess_priv);
memset(sess_priv, 0, sizeof(struct openssl_asym_session));
struct rte_mempool *sess_mp = rte_mempool_from_obj(sess_priv);
set_asym_session_private_data(sess, index, NULL);
rte_mempool_put(sess_mp, sess_priv);
}
}
struct rte_cryptodev_ops openssl_pmd_ops = {
.dev_configure = openssl_pmd_config,
.dev_start = openssl_pmd_start,
@ -733,8 +1062,11 @@ struct rte_cryptodev_ops openssl_pmd_ops = {
.queue_pair_count = openssl_pmd_qp_count,
.sym_session_get_size = openssl_pmd_sym_session_get_size,
.asym_session_get_size = openssl_pmd_asym_session_get_size,
.sym_session_configure = openssl_pmd_sym_session_configure,
.sym_session_clear = openssl_pmd_sym_session_clear
.asym_session_configure = openssl_pmd_asym_session_configure,
.sym_session_clear = openssl_pmd_sym_session_clear,
.asym_session_clear = openssl_pmd_asym_session_clear
};
struct rte_cryptodev_ops *rte_openssl_pmd_ops = &openssl_pmd_ops;

19
drivers/crypto/openssl/rte_openssl_pmd_private.h
View File

@ -8,6 +8,7 @@
#include <openssl/evp.h>
#include <openssl/hmac.h>
#include <openssl/des.h>
#include <openssl/rsa.h>
#define CRYPTODEV_NAME_OPENSSL_PMD crypto_openssl
/**< Open SSL Crypto PMD device name */
@ -142,6 +143,24 @@ struct openssl_session {
} __rte_cache_aligned;
/** OPENSSL crypto private asymmetric session structure */
struct openssl_asym_session {
enum rte_crypto_asym_xform_type xfrm_type;
union {
struct rsa {
RSA *rsa;
} r;
struct exp {
BIGNUM *exp;
BIGNUM *mod;
BN_CTX *ctx;
} e;
struct mod {
BIGNUM *modulus;
BN_CTX *ctx;
} m;
} u;
} __rte_cache_aligned;
/** Set and validate OPENSSL crypto session parameters */
extern int
openssl_set_session_parameters(struct openssl_session *sess,