c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2024-11-18 18:31:00 +03:00
Code Issues Packages Projects Releases Wiki Activity
a3f82aec93
mirror_zfs/module/icp/algs/sha2/sha2_generic.c
Richard Yao 8846139b45 SHA2Init() should use signed assertions when checking an enum 
The recent 4c5fec01a4 commit caused
Coverity to report that ASSERT3U(algotype, >=, SHA256_MECH_INFO_TYPE);
is always true. That is because the signed algotype and signed
SHA256_MECH_INFO_TYPE values were cast to unsigned types. To fix this,
we switch the assertions to use ASSERT3S(), which retains the signedness
of the original values for the comparison.

Reviewed-by: Tino Reichardt <milky-zfs@mcmilk.de>
Reviewed-by: Alexander Motin <mav@FreeBSD.org>
Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu>
Reported-by: Coverity (CID-1535300)
Closes #14573
2023-03-06 15:26:43 -08:00

563 lines
16 KiB
C
Raw Blame History

/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or https://opensource.org/licenses/CDDL-1.0.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Based on public domain code in cppcrypto 0.10.
* Copyright (c) 2022 Tino Reichardt <milky-zfs@mcmilk.de>
*/
#include <sys/zfs_context.h>
#include <sys/zfs_impl.h>
#include <sys/sha2.h>
#include <sha2/sha2_impl.h>
/*
* On i386, gcc brings this for sha512_generic():
* error: the frame size of 1040 bytes is larger than 1024
*/
#if defined(__GNUC__) && defined(_ILP32)
#pragma GCC diagnostic ignored "-Wframe-larger-than="
#endif
/* SHA256 */
static const uint32_t SHA256_K[64] = {
0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
};
#define Ch(x, y, z) ((z) ^ ((x) & ((y) ^ (z))))
#define Maj(x, y, z) (((y) & (z)) | (((y) | (z)) & (x)))
#define rotr32(x, n) (((x) >> n) | ((x) << (32 - n)))
#define sum0(x) (rotr32((x), 2) ^ rotr32((x), 13) ^ rotr32((x), 22))
#define sum1(x) (rotr32((x), 6) ^ rotr32((x), 11) ^ rotr32((x), 25))
#define sigma0(x) (rotr32((x), 7) ^ rotr32((x), 18) ^ ((x) >> 3))
#define sigma1(x) (rotr32((x), 17) ^ rotr32((x), 19) ^ ((x) >> 10))
#define WU(j) (W[j & 15] += sigma1(W[(j + 14) & 15]) \
+ W[(j + 9) & 15] + sigma0(W[(j + 1) & 15]))
#define COMPRESS(i, j, K) \
T1 = h + sum1(e) + Ch(e, f, g) + K[i + j] + (i? WU(j): W[j]); \
T2 = sum0(a) + Maj(a, b, c); \
h = g, g = f, f = e, e = d + T1; \
d = c, c = b, b = a, a = T1 + T2;
static void sha256_generic(uint32_t state[8], const void *data, size_t num_blks)
{
uint64_t blk;
for (blk = 0; blk < num_blks; blk++) {
uint32_t W[16];
uint32_t a, b, c, d, e, f, g, h;
uint32_t T1, T2;
int i;
for (i = 0; i < 16; i++) {
W[i] = BE_32( \
(((const uint32_t *)(data))[blk * 16 + i]));
}
a = state[0];
b = state[1];
c = state[2];
d = state[3];
e = state[4];
f = state[5];
g = state[6];
h = state[7];
for (i = 0; i <= 63; i += 16) {
COMPRESS(i, 0, SHA256_K);
COMPRESS(i, 1, SHA256_K);
COMPRESS(i, 2, SHA256_K);
COMPRESS(i, 3, SHA256_K);
COMPRESS(i, 4, SHA256_K);
COMPRESS(i, 5, SHA256_K);
COMPRESS(i, 6, SHA256_K);
COMPRESS(i, 7, SHA256_K);
COMPRESS(i, 8, SHA256_K);
COMPRESS(i, 9, SHA256_K);
COMPRESS(i, 10, SHA256_K);
COMPRESS(i, 11, SHA256_K);
COMPRESS(i, 12, SHA256_K);
COMPRESS(i, 13, SHA256_K);
COMPRESS(i, 14, SHA256_K);
COMPRESS(i, 15, SHA256_K);
}
state[0] += a;
state[1] += b;
state[2] += c;
state[3] += d;
state[4] += e;
state[5] += f;
state[6] += g;
state[7] += h;
}
}
#undef sum0
#undef sum1
#undef sigma0
#undef sigma1
#define rotr64(x, n) (((x) >> n) | ((x) << (64 - n)))
#define sum0(x) (rotr64((x), 28) ^ rotr64((x), 34) ^ rotr64((x), 39))
#define sum1(x) (rotr64((x), 14) ^ rotr64((x), 18) ^ rotr64((x), 41))
#define sigma0(x) (rotr64((x), 1) ^ rotr64((x), 8) ^ ((x) >> 7))
#define sigma1(x) (rotr64((x), 19) ^ rotr64((x), 61) ^ ((x) >> 6))
/* SHA512 */
static const uint64_t SHA512_K[80] = {
0x428a2f98d728ae22, 0x7137449123ef65cd, 0xb5c0fbcfec4d3b2f,
0xe9b5dba58189dbbc, 0x3956c25bf348b538, 0x59f111f1b605d019,
0x923f82a4af194f9b, 0xab1c5ed5da6d8118, 0xd807aa98a3030242,
0x12835b0145706fbe, 0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2,
0x72be5d74f27b896f, 0x80deb1fe3b1696b1, 0x9bdc06a725c71235,
0xc19bf174cf692694, 0xe49b69c19ef14ad2, 0xefbe4786384f25e3,
0x0fc19dc68b8cd5b5, 0x240ca1cc77ac9c65, 0x2de92c6f592b0275,
0x4a7484aa6ea6e483, 0x5cb0a9dcbd41fbd4, 0x76f988da831153b5,
0x983e5152ee66dfab, 0xa831c66d2db43210, 0xb00327c898fb213f,
0xbf597fc7beef0ee4, 0xc6e00bf33da88fc2, 0xd5a79147930aa725,
0x06ca6351e003826f, 0x142929670a0e6e70, 0x27b70a8546d22ffc,
0x2e1b21385c26c926, 0x4d2c6dfc5ac42aed, 0x53380d139d95b3df,
0x650a73548baf63de, 0x766a0abb3c77b2a8, 0x81c2c92e47edaee6,
0x92722c851482353b, 0xa2bfe8a14cf10364, 0xa81a664bbc423001,
0xc24b8b70d0f89791, 0xc76c51a30654be30, 0xd192e819d6ef5218,
0xd69906245565a910, 0xf40e35855771202a, 0x106aa07032bbd1b8,
0x19a4c116b8d2d0c8, 0x1e376c085141ab53, 0x2748774cdf8eeb99,
0x34b0bcb5e19b48a8, 0x391c0cb3c5c95a63, 0x4ed8aa4ae3418acb,
0x5b9cca4f7763e373, 0x682e6ff3d6b2b8a3, 0x748f82ee5defb2fc,
0x78a5636f43172f60, 0x84c87814a1f0ab72, 0x8cc702081a6439ec,
0x90befffa23631e28, 0xa4506cebde82bde9, 0xbef9a3f7b2c67915,
0xc67178f2e372532b, 0xca273eceea26619c, 0xd186b8c721c0c207,
0xeada7dd6cde0eb1e, 0xf57d4f7fee6ed178, 0x06f067aa72176fba,
0x0a637dc5a2c898a6, 0x113f9804bef90dae, 0x1b710b35131c471b,
0x28db77f523047d84, 0x32caab7b40c72493, 0x3c9ebe0a15c9bebc,
0x431d67c49c100d4c, 0x4cc5d4becb3e42b6, 0x597f299cfc657e2a,
0x5fcb6fab3ad6faec, 0x6c44198c4a475817
};
static void sha512_generic(uint64_t state[8], const void *data, size_t num_blks)
{
uint64_t blk;
for (blk = 0; blk < num_blks; blk++) {
uint64_t W[16];
uint64_t a, b, c, d, e, f, g, h;
uint64_t T1, T2;
int i;
for (i = 0; i < 16; i++) {
W[i] = BE_64( \
(((const uint64_t *)(data))[blk * 16 + i]));
}
a = state[0];
b = state[1];
c = state[2];
d = state[3];
e = state[4];
f = state[5];
g = state[6];
h = state[7];
for (i = 0; i <= 79; i += 16) {
COMPRESS(i, 0, SHA512_K);
COMPRESS(i, 1, SHA512_K);
COMPRESS(i, 2, SHA512_K);
COMPRESS(i, 3, SHA512_K);
COMPRESS(i, 4, SHA512_K);
COMPRESS(i, 5, SHA512_K);
COMPRESS(i, 6, SHA512_K);
COMPRESS(i, 7, SHA512_K);
COMPRESS(i, 8, SHA512_K);
COMPRESS(i, 9, SHA512_K);
COMPRESS(i, 10, SHA512_K);
COMPRESS(i, 11, SHA512_K);
COMPRESS(i, 12, SHA512_K);
COMPRESS(i, 13, SHA512_K);
COMPRESS(i, 14, SHA512_K);
COMPRESS(i, 15, SHA512_K);
}
state[0] += a;
state[1] += b;
state[2] += c;
state[3] += d;
state[4] += e;
state[5] += f;
state[6] += g;
state[7] += h;
}
}
static void sha256_update(sha256_ctx *ctx, const uint8_t *data, size_t len)
{
uint64_t pos = ctx->count[0];
uint64_t total = ctx->count[1];
uint8_t *m = ctx->wbuf;
const sha256_ops_t *ops = ctx->ops;
if (pos && pos + len >= 64) {
memcpy(m + pos, data, 64 - pos);
ops->transform(ctx->state, m, 1);
len -= 64 - pos;
total += (64 - pos) * 8;
data += 64 - pos;
pos = 0;
}
if (len >= 64) {
uint32_t blocks = len / 64;
uint32_t bytes = blocks * 64;
ops->transform(ctx->state, data, blocks);
len -= bytes;
total += (bytes) * 8;
data += bytes;
}
memcpy(m + pos, data, len);
pos += len;
total += len * 8;
ctx->count[0] = pos;
ctx->count[1] = total;
}
static void sha512_update(sha512_ctx *ctx, const uint8_t *data, size_t len)
{
uint64_t pos = ctx->count[0];
uint64_t total = ctx->count[1];
uint8_t *m = ctx->wbuf;
const sha512_ops_t *ops = ctx->ops;
if (pos && pos + len >= 128) {
memcpy(m + pos, data, 128 - pos);
ops->transform(ctx->state, m, 1);
len -= 128 - pos;
total += (128 - pos) * 8;
data += 128 - pos;
pos = 0;
}
if (len >= 128) {
uint64_t blocks = len / 128;
uint64_t bytes = blocks * 128;
ops->transform(ctx->state, data, blocks);
len -= bytes;
total += (bytes) * 8;
data += bytes;
}
memcpy(m + pos, data, len);
pos += len;
total += len * 8;
ctx->count[0] = pos;
ctx->count[1] = total;
}
static void sha256_final(sha256_ctx *ctx, uint8_t *result, int bits)
{
uint64_t mlen, pos = ctx->count[0];
uint8_t *m = ctx->wbuf;
uint32_t *R = (uint32_t *)result;
const sha256_ops_t *ops = ctx->ops;
m[pos++] = 0x80;
if (pos > 56) {
memset(m + pos, 0, 64 - pos);
ops->transform(ctx->state, m, 1);
pos = 0;
}
memset(m + pos, 0, 64 - pos);
mlen = BE_64(ctx->count[1]);
memcpy(m + (64 - 8), &mlen, 64 / 8);
ops->transform(ctx->state, m, 1);
switch (bits) {
case 224: /* 28 - unused currently /TR */
R[0] = BE_32(ctx->state[0]);
R[1] = BE_32(ctx->state[1]);
R[2] = BE_32(ctx->state[2]);
R[3] = BE_32(ctx->state[3]);
R[4] = BE_32(ctx->state[4]);
R[5] = BE_32(ctx->state[5]);
R[6] = BE_32(ctx->state[6]);
break;
case 256: /* 32 */
R[0] = BE_32(ctx->state[0]);
R[1] = BE_32(ctx->state[1]);
R[2] = BE_32(ctx->state[2]);
R[3] = BE_32(ctx->state[3]);
R[4] = BE_32(ctx->state[4]);
R[5] = BE_32(ctx->state[5]);
R[6] = BE_32(ctx->state[6]);
R[7] = BE_32(ctx->state[7]);
break;
}
memset(ctx, 0, sizeof (*ctx));
}
static void sha512_final(sha512_ctx *ctx, uint8_t *result, int bits)
{
uint64_t mlen, pos = ctx->count[0];
uint8_t *m = ctx->wbuf, *r;
uint64_t *R = (uint64_t *)result;
const sha512_ops_t *ops = ctx->ops;
m[pos++] = 0x80;
if (pos > 112) {
memset(m + pos, 0, 128 - pos);
ops->transform(ctx->state, m, 1);
pos = 0;
}
memset(m + pos, 0, 128 - pos);
mlen = BE_64(ctx->count[1]);
memcpy(m + (128 - 8), &mlen, 64 / 8);
ops->transform(ctx->state, m, 1);
switch (bits) {
case 224: /* 28 => 3,5 x 8 */
r = result + 24;
R[0] = BE_64(ctx->state[0]);
R[1] = BE_64(ctx->state[1]);
R[2] = BE_64(ctx->state[2]);
/* last 4 bytes are special here */
*r++ = (uint8_t)(ctx->state[3] >> 56);
*r++ = (uint8_t)(ctx->state[3] >> 48);
*r++ = (uint8_t)(ctx->state[3] >> 40);
*r++ = (uint8_t)(ctx->state[3] >> 32);
break;
case 256: /* 32 */
R[0] = BE_64(ctx->state[0]);
R[1] = BE_64(ctx->state[1]);
R[2] = BE_64(ctx->state[2]);
R[3] = BE_64(ctx->state[3]);
break;
case 384: /* 48 */
R[0] = BE_64(ctx->state[0]);
R[1] = BE_64(ctx->state[1]);
R[2] = BE_64(ctx->state[2]);
R[3] = BE_64(ctx->state[3]);
R[4] = BE_64(ctx->state[4]);
R[5] = BE_64(ctx->state[5]);
break;
case 512: /* 64 */
R[0] = BE_64(ctx->state[0]);
R[1] = BE_64(ctx->state[1]);
R[2] = BE_64(ctx->state[2]);
R[3] = BE_64(ctx->state[3]);
R[4] = BE_64(ctx->state[4]);
R[5] = BE_64(ctx->state[5]);
R[6] = BE_64(ctx->state[6]);
R[7] = BE_64(ctx->state[7]);
break;
}
memset(ctx, 0, sizeof (*ctx));
}
/* SHA2 Init function */
void
SHA2Init(int algotype, SHA2_CTX *ctx)
{
sha256_ctx *ctx256 = &ctx->sha256;
sha512_ctx *ctx512 = &ctx->sha512;
ASSERT3S(algotype, >=, SHA256_MECH_INFO_TYPE);
ASSERT3S(algotype, <=, SHA512_256_MECH_INFO_TYPE);
memset(ctx, 0, sizeof (*ctx));
ctx->algotype = algotype;
switch (ctx->algotype) {
case SHA256_MECH_INFO_TYPE:
case SHA256_HMAC_MECH_INFO_TYPE:
case SHA256_HMAC_GEN_MECH_INFO_TYPE:
ctx256->state[0] = 0x6a09e667;
ctx256->state[1] = 0xbb67ae85;
ctx256->state[2] = 0x3c6ef372;
ctx256->state[3] = 0xa54ff53a;
ctx256->state[4] = 0x510e527f;
ctx256->state[5] = 0x9b05688c;
ctx256->state[6] = 0x1f83d9ab;
ctx256->state[7] = 0x5be0cd19;
ctx256->count[0] = 0;
ctx256->ops = sha256_get_ops();
break;
case SHA384_MECH_INFO_TYPE:
case SHA384_HMAC_MECH_INFO_TYPE:
case SHA384_HMAC_GEN_MECH_INFO_TYPE:
ctx512->state[0] = 0xcbbb9d5dc1059ed8ULL;
ctx512->state[1] = 0x629a292a367cd507ULL;
ctx512->state[2] = 0x9159015a3070dd17ULL;
ctx512->state[3] = 0x152fecd8f70e5939ULL;
ctx512->state[4] = 0x67332667ffc00b31ULL;
ctx512->state[5] = 0x8eb44a8768581511ULL;
ctx512->state[6] = 0xdb0c2e0d64f98fa7ULL;
ctx512->state[7] = 0x47b5481dbefa4fa4ULL;
ctx512->count[0] = 0;
ctx512->count[1] = 0;
ctx512->ops = sha512_get_ops();
break;
case SHA512_MECH_INFO_TYPE:
case SHA512_HMAC_MECH_INFO_TYPE:
case SHA512_HMAC_GEN_MECH_INFO_TYPE:
ctx512->state[0] = 0x6a09e667f3bcc908ULL;
ctx512->state[1] = 0xbb67ae8584caa73bULL;
ctx512->state[2] = 0x3c6ef372fe94f82bULL;
ctx512->state[3] = 0xa54ff53a5f1d36f1ULL;
ctx512->state[4] = 0x510e527fade682d1ULL;
ctx512->state[5] = 0x9b05688c2b3e6c1fULL;
ctx512->state[6] = 0x1f83d9abfb41bd6bULL;
ctx512->state[7] = 0x5be0cd19137e2179ULL;
ctx512->count[0] = 0;
ctx512->count[1] = 0;
ctx512->ops = sha512_get_ops();
break;
case SHA512_224_MECH_INFO_TYPE:
ctx512->state[0] = 0x8c3d37c819544da2ULL;
ctx512->state[1] = 0x73e1996689dcd4d6ULL;
ctx512->state[2] = 0x1dfab7ae32ff9c82ULL;
ctx512->state[3] = 0x679dd514582f9fcfULL;
ctx512->state[4] = 0x0f6d2b697bd44da8ULL;
ctx512->state[5] = 0x77e36f7304c48942ULL;
ctx512->state[6] = 0x3f9d85a86a1d36c8ULL;
ctx512->state[7] = 0x1112e6ad91d692a1ULL;
ctx512->count[0] = 0;
ctx512->count[1] = 0;
ctx512->ops = sha512_get_ops();
break;
case SHA512_256_MECH_INFO_TYPE:
ctx512->state[0] = 0x22312194fc2bf72cULL;
ctx512->state[1] = 0x9f555fa3c84c64c2ULL;
ctx512->state[2] = 0x2393b86b6f53b151ULL;
ctx512->state[3] = 0x963877195940eabdULL;
ctx512->state[4] = 0x96283ee2a88effe3ULL;
ctx512->state[5] = 0xbe5e1e2553863992ULL;
ctx512->state[6] = 0x2b0199fc2c85b8aaULL;
ctx512->state[7] = 0x0eb72ddc81c52ca2ULL;
ctx512->count[0] = 0;
ctx512->count[1] = 0;
ctx512->ops = sha512_get_ops();
break;
}
}
/* SHA2 Update function */
void
SHA2Update(SHA2_CTX *ctx, const void *data, size_t len)
{
/* check for zero input length */
if (len == 0)
return;
ASSERT3P(data, !=, NULL);
switch (ctx->algotype) {
case SHA256_MECH_INFO_TYPE:
case SHA256_HMAC_MECH_INFO_TYPE:
case SHA256_HMAC_GEN_MECH_INFO_TYPE:
sha256_update(&ctx->sha256, data, len);
break;
case SHA384_MECH_INFO_TYPE:
case SHA384_HMAC_MECH_INFO_TYPE:
case SHA384_HMAC_GEN_MECH_INFO_TYPE:
sha512_update(&ctx->sha512, data, len);
break;
case SHA512_MECH_INFO_TYPE:
case SHA512_HMAC_MECH_INFO_TYPE:
case SHA512_HMAC_GEN_MECH_INFO_TYPE:
sha512_update(&ctx->sha512, data, len);
break;
case SHA512_224_MECH_INFO_TYPE:
sha512_update(&ctx->sha512, data, len);
break;
case SHA512_256_MECH_INFO_TYPE:
sha512_update(&ctx->sha512, data, len);
break;
}
}
/* SHA2Final function */
void
SHA2Final(void *digest, SHA2_CTX *ctx)
{
switch (ctx->algotype) {
case SHA256_MECH_INFO_TYPE:
case SHA256_HMAC_MECH_INFO_TYPE:
case SHA256_HMAC_GEN_MECH_INFO_TYPE:
sha256_final(&ctx->sha256, digest, 256);
break;
case SHA384_MECH_INFO_TYPE:
case SHA384_HMAC_MECH_INFO_TYPE:
case SHA384_HMAC_GEN_MECH_INFO_TYPE:
sha512_final(&ctx->sha512, digest, 384);
break;
case SHA512_MECH_INFO_TYPE:
case SHA512_HMAC_MECH_INFO_TYPE:
case SHA512_HMAC_GEN_MECH_INFO_TYPE:
sha512_final(&ctx->sha512, digest, 512);
break;
case SHA512_224_MECH_INFO_TYPE:
sha512_final(&ctx->sha512, digest, 224);
break;
case SHA512_256_MECH_INFO_TYPE:
sha512_final(&ctx->sha512, digest, 256);
break;
}
}
/* the generic implementation is always okay */
static boolean_t sha2_is_supported(void)
{
return (B_TRUE);
}
const sha256_ops_t sha256_generic_impl = {
.name = "generic",
.transform = sha256_generic,
.is_supported = sha2_is_supported
};
const sha512_ops_t sha512_generic_impl = {
.name = "generic",
.transform = sha512_generic,
.is_supported = sha2_is_supported
};
Reference in New Issue View Git Blame Copy Permalink