denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

padlock: Remove legacy hardware crypto plugin

Browse Source 
Unlikely there is even still hardware that would support this.

Also removed the CPU feature detection for these chips.
This commit is contained in:
Tobias Brunner
2026-07-24 15:44:44 +02:00
parent 9f6273786e
commit 10beab8bcd
14 changed files with 1 additions and 910 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
-4
View File
@@ -151,7 +151,6 @@ ARG_ENABL_SET([ml], [enable Module-Lattice-based crypto (ML-KEM) plu
ARG_DISBL_SET([nonce], [disable nonce generation plugin.])
ARG_DISBL_SET([openssl], [disable the OpenSSL crypto plugin.])
ARG_ENABL_SET([wolfssl], [enables the wolfSSL crypto plugin.])
ARG_ENABL_SET([padlock], [enables VIA Padlock crypto plugin.])
ARG_DISBL_SET([random], [disable RNG implementation on top of /dev/(u)random.])
ARG_ENABL_SET([rc2], [enable RC2 software implementation plugin.])
ARG_ENABL_SET([rdrand], [enable Intel RDRAND random generator plugin.])
@@ -1518,7 +1517,6 @@ ADD_PLUGIN([sshkey], [s charon swanctl pki nm cmd])
ADD_PLUGIN([dnscert], [c charon])
ADD_PLUGIN([ipseckey], [c charon])
ADD_PLUGIN([pem], [s charon swanctl pki scripts attest nm cmd aikgen fd fc])
ADD_PLUGIN([padlock], [s charon])
ADD_PLUGIN([openssl], [s charon swanctl pki scripts attest nm cmd aikgen fd])
ADD_PLUGIN([wolfssl], [s charon swanctl pki scripts attest nm cmd aikgen])
ADD_PLUGIN([gcrypt], [s charon swanctl pki scripts attest nm cmd aikgen])
@@ -1683,7 +1681,6 @@ AM_CONDITIONAL(USE_CMAC, test x$cmac = xtrue)
AM_CONDITIONAL(USE_XCBC, test x$xcbc = xtrue)
AM_CONDITIONAL(USE_MYSQL, test x$mysql = xtrue)
AM_CONDITIONAL(USE_SQLITE, test x$sqlite = xtrue)
AM_CONDITIONAL(USE_PADLOCK, test x$padlock = xtrue)
AM_CONDITIONAL(USE_OPENSSL, test x$openssl = xtrue)
AM_CONDITIONAL(USE_WOLFSSL, test x$wolfssl = xtrue)
AM_CONDITIONAL(USE_GCRYPT, test x$gcrypt = xtrue)
@@ -1967,7 +1964,6 @@ AC_CONFIG_FILES([
src/libstrongswan/plugins/ldap/Makefile
src/libstrongswan/plugins/mysql/Makefile
src/libstrongswan/plugins/sqlite/Makefile
src/libstrongswan/plugins/padlock/Makefile
src/libstrongswan/plugins/openssl/Makefile
src/libstrongswan/plugins/wolfssl/Makefile
src/libstrongswan/plugins/gcrypt/Makefile
scripts/test.sh
+1 -1
View File
@@ -263,7 +263,7 @@ all|alpine|codeql|coverage|sonarcloud|no-dbg|no-testable-ke)
fi
CONFIG="--enable-all --disable-android-log
--disable-kernel-pfroute
--disable-lock-profiler --disable-padlock --disable-fuzzing
--disable-lock-profiler --disable-fuzzing
--disable-osx-attr --disable-tkm
--disable-unwind-backtraces
--disable-svc --disable-dbghelp-backtraces --disable-socket-win
src/libstrongswan/Makefile.am
-7
View File
@@ -572,13 +572,6 @@ if MONOLITHIC
endif
endif
if USE_PADLOCK
SUBDIRS += plugins/padlock
if MONOLITHIC
libstrongswan_la_LIBADD += plugins/padlock/libstrongswan-padlock.la
endif
endif
if USE_OPENSSL
SUBDIRS += plugins/openssl
if MONOLITHIC
src/libstrongswan/plugins/padlock/Makefile.am
-19
View File
@@ -1,19 +0,0 @@
AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan
AM_CFLAGS = \
$(PLUGIN_CFLAGS)
if MONOLITHIC
noinst_LTLIBRARIES = libstrongswan-padlock.la
else
plugin_LTLIBRARIES = libstrongswan-padlock.la
endif
libstrongswan_padlock_la_SOURCES = \
padlock_plugin.h padlock_plugin.c \
padlock_aes_crypter.c padlock_aes_crypter.h \
padlock_sha1_hasher.c padlock_sha1_hasher.h \
padlock_rng.c padlock_rng.h
libstrongswan_padlock_la_LDFLAGS = -module -avoid-version
src/libstrongswan/plugins/padlock/padlock_aes_crypter.c
-200
View File
@@ -1,200 +0,0 @@
/*
* Copyright (C) 2008 Thomas Kallenberg
* Copyright (C) 2008 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "padlock_aes_crypter.h"
#include <stdio.h>
#define AES_BLOCK_SIZE 16
#define PADLOCK_ALIGN __attribute__ ((__aligned__(16)))
typedef struct private_padlock_aes_crypter_t private_padlock_aes_crypter_t;
/**
* Private data of padlock_aes_crypter_t
*/
struct private_padlock_aes_crypter_t {
/**
* Public part of this class.
*/
padlock_aes_crypter_t public;
/*
* the key
*/
chunk_t key;
};
/**
* Control word structure to pass to crypt operations
*/
typedef struct {
u_int __attribute__ ((__packed__))
rounds:4,
algo:3,
keygen:1,
interm:1,
encdec:1,
ksize:2;
/* microcode needs additional bytes for calculation */
u_char buf[124];
} cword;
/**
* Invoke the actual de/encryption
*/
static void padlock_crypt(void *key, void *ctrl, void *src, void *dst,
int count, void *iv)
{
asm volatile(
"pushl %%eax\n pushl %%ebx\n pushl %%ecx\n"
"pushl %%edx\n pushl %%esi\n pushl %%edi\n"
"pushfl\n popfl\n"
"movl %0, %%eax\n"
"movl %1, %%ebx\n"
"movl %2, %%ecx\n"
"movl %3, %%edx\n"
"movl %4, %%esi\n"
"movl %5, %%edi\n"
"rep\n"
".byte 0x0f, 0xa7, 0xd0\n"
"popl %%edi\n popl %%esi\n popl %%edx\n"
"popl %%ecx\n popl %%ebx\n popl %%eax\n"
:
: "m"(iv),"m"(key), "m"(count), "m"(ctrl), "m"(src), "m"(dst)
: "eax", "ecx", "edx", "esi", "edi");
}
/**
* Do encryption/decryption operation using Padlock control word
*/
static void crypt(private_padlock_aes_crypter_t *this, char *iv,
chunk_t src, chunk_t *dst, bool enc)
{
cword cword PADLOCK_ALIGN;
u_char key_aligned[256] PADLOCK_ALIGN;
u_char iv_aligned[16] PADLOCK_ALIGN;
memset(&cword, 0, sizeof(cword));
/* set encryption/decryption flag */
cword.encdec = enc;
/* calculate rounds and key size */
cword.rounds = 10 + (this->key.len - 16) / 4;
cword.ksize = (this->key.len - 16) / 8;
/* enable autoalign */
cword.algo |= 2;
/* move data to aligned buffers */
memcpy(iv_aligned, iv, sizeof(iv_aligned));
memcpy(key_aligned, this->key.ptr, this->key.len);
*dst = chunk_alloc(src.len);
padlock_crypt(key_aligned, &cword, src.ptr, dst->ptr,
src.len / AES_BLOCK_SIZE, iv_aligned);
memwipe(key_aligned, sizeof(key_aligned));
}
METHOD(crypter_t, decrypt, bool,
private_padlock_aes_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *dst)
{
crypt(this, iv.ptr, data, dst, TRUE);
return TRUE;
}
METHOD(crypter_t, encrypt, bool,
private_padlock_aes_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *dst)
{
crypt(this, iv.ptr, data, dst, FALSE);
return TRUE;
}
METHOD(crypter_t, get_block_size, size_t,
private_padlock_aes_crypter_t *this)
{
return AES_BLOCK_SIZE;
}
METHOD(crypter_t, get_iv_size, size_t,
private_padlock_aes_crypter_t *this)
{
return AES_BLOCK_SIZE;
}
METHOD(crypter_t, get_key_size, size_t,
private_padlock_aes_crypter_t *this)
{
return this->key.len;
}
METHOD(crypter_t, set_key, bool,
private_padlock_aes_crypter_t *this, chunk_t key)
{
memcpy(this->key.ptr, key.ptr, min(key.len, this->key.len));
return TRUE;
}
METHOD(crypter_t, destroy, void,
private_padlock_aes_crypter_t *this)
{
chunk_clear(&this->key);
free(this);
}
/*
* Described in header
*/
padlock_aes_crypter_t *padlock_aes_crypter_create(encryption_algorithm_t algo,
size_t key_size)
{
private_padlock_aes_crypter_t *this;
if (algo != ENCR_AES_CBC)
{
return NULL;
}
switch (key_size)
{
case 0:
key_size = 16;
/* FALL */
case 16: /* AES 128 */
break;
case 24: /* AES-192 */
case 32: /* AES-256 */
/* These need an expanded key, currently not supported, FALL */
default:
return NULL;
}
INIT(this,
.public = {
.crypter = {
.encrypt = _encrypt,
.decrypt = _decrypt,
.get_block_size = _get_block_size,
.get_iv_size = _get_iv_size,
.get_key_size = _get_key_size,
.set_key = _set_key,
.destroy = _destroy,
},
},
.key = chunk_alloc(key_size),
);
return &this->public;
}
src/libstrongswan/plugins/padlock/padlock_aes_crypter.h
-51
View File
@@ -1,51 +0,0 @@
/*
* Copyright (C) 2008 Thomas Kallenberg
* Copyright (C) 2008 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup padlock_aes_crypter padlock_aes_crypter
* @{ @ingroup padlock_p
*/
#ifndef PADLOCK_AES_CRYPTER_H_
#define PADLOCK_AES_CRYPTER_H_
typedef struct padlock_aes_crypter_t padlock_aes_crypter_t;
#include <crypto/crypters/crypter.h>
/**
* Implementation of AES-128 using VIA Padlock.
*/
struct padlock_aes_crypter_t {
/**
* Implements crypter_t interface.
*/
crypter_t crypter;
};
/**
* Constructor to create padlock_aes_crypter_t.
*
* @param key_size key size in bytes, currently supports only 16.
* @param algo algorithm to implement, must be ENCR_AES_CBC
* @return padlock_aes_crypter_t, NULL if not supported
*/
padlock_aes_crypter_t *padlock_aes_crypter_create(encryption_algorithm_t algo,
size_t key_size);
#endif /** PADLOCK_AES_CRYPTER_H_ @}*/
src/libstrongswan/plugins/padlock/padlock_plugin.c
-132
View File
@@ -1,132 +0,0 @@
/*
* Copyright (C) 2013 Tobias Brunner
* Copyright (C) 2008 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "padlock_plugin.h"
#include "padlock_aes_crypter.h"
#include "padlock_sha1_hasher.h"
#include "padlock_rng.h"
#include <stdio.h>
#include <library.h>
#include <plugins/plugin_feature.h>
#include <utils/cpu_feature.h>
#include <utils/debug.h>
typedef struct private_padlock_plugin_t private_padlock_plugin_t;
typedef enum padlock_feature_t padlock_feature_t;
/**
* private data of aes_plugin
*/
struct private_padlock_plugin_t {
/**
* public functions
*/
padlock_plugin_t public;
/**
* features supported by Padlock
*/
cpu_feature_t features;
};
METHOD(plugin_t, get_name, char*,
private_padlock_plugin_t *this)
{
return "padlock";
}
METHOD(plugin_t, get_features, int,
private_padlock_plugin_t *this, plugin_feature_t *features[])
{
static plugin_feature_t f_rng[] = {
PLUGIN_REGISTER(RNG, padlock_rng_create),
PLUGIN_PROVIDE(RNG, RNG_WEAK),
PLUGIN_PROVIDE(RNG, RNG_STRONG),
PLUGIN_PROVIDE(RNG, RNG_TRUE),
};
static plugin_feature_t f_aes[] = {
PLUGIN_REGISTER(CRYPTER, padlock_aes_crypter_create),
PLUGIN_PROVIDE(CRYPTER, ENCR_AES_CBC, 16),
};
static plugin_feature_t f_sha1[] = {
PLUGIN_REGISTER(HASHER, padlock_sha1_hasher_create),
PLUGIN_PROVIDE(HASHER, HASH_SHA1),
};
static plugin_feature_t f[countof(f_rng) + countof(f_aes) +
countof(f_sha1)] = {};
static int count = 0;
if (!count)
{ /* initialize only once */
if (this->features & CPU_FEATURE_PADLOCK_RNG_ENABLED)
{
plugin_features_add(f, f_rng, countof(f_rng), &count);
}
if (this->features & CPU_FEATURE_PADLOCK_ACE2_ENABLED)
{
plugin_features_add(f, f_aes, countof(f_aes), &count);
}
if (this->features & CPU_FEATURE_PADLOCK_PHE_ENABLED)
{
plugin_features_add(f, f_sha1, countof(f_sha1), &count);
}
}
*features = f;
return count;
}
METHOD(plugin_t, destroy, void,
private_padlock_plugin_t *this)
{
free(this);
}
/*
* see header file
*/
PLUGIN_DEFINE(padlock)
{
private_padlock_plugin_t *this;
INIT(this,
.public = {
.plugin = {
.get_name = _get_name,
.get_features = _get_features,
.destroy = _destroy,
},
},
.features = cpu_feature_get_all(),
);
DBG1(DBG_LIB, "Padlock features supported:%s%s%s%s%s, enabled:%s%s%s%s%s",
this->features & CPU_FEATURE_PADLOCK_RNG_AVAILABLE ? " RNG" : "",
this->features & CPU_FEATURE_PADLOCK_ACE_AVAILABLE ? " ACE" : "",
this->features & CPU_FEATURE_PADLOCK_ACE2_AVAILABLE ? " ACE2" : "",
this->features & CPU_FEATURE_PADLOCK_PHE_AVAILABLE ? " PHE" : "",
this->features & CPU_FEATURE_PADLOCK_PMM_AVAILABLE ? " PMM" : "",
this->features & CPU_FEATURE_PADLOCK_RNG_ENABLED ? " RNG" : "",
this->features & CPU_FEATURE_PADLOCK_ACE_ENABLED ? " ACE" : "",
this->features & CPU_FEATURE_PADLOCK_ACE2_ENABLED ? " ACE2" : "",
this->features & CPU_FEATURE_PADLOCK_PHE_ENABLED ? " PHE" : "",
this->features & CPU_FEATURE_PADLOCK_PMM_ENABLED ? " PMM" : "");
return &this->public.plugin;
}
src/libstrongswan/plugins/padlock/padlock_plugin.h
-43
View File
@@ -1,43 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup padlock_p padlock
* @ingroup plugins
*
* @defgroup padlock_plugin padlock_plugin
* @{ @ingroup padlock_p
*/
#ifndef PADLOCK_PLUGIN_H_
#define PADLOCK_PLUGIN_H_
#include <plugins/plugin.h>
typedef struct padlock_plugin_t padlock_plugin_t;
/**
* Plugin implementing VIA Padlock crypto functions
*/
struct padlock_plugin_t {
/**
* implements plugin interface
*/
plugin_t plugin;
};
#endif /** PADLOCK_PLUGIN_H_ @}*/
src/libstrongswan/plugins/padlock/padlock_rng.c
-137
View File
@@ -1,137 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "padlock_rng.h"
typedef struct private_padlock_rng_t private_padlock_rng_t;
typedef enum padlock_quality_factor_t padlock_quality_factor_t;
/**
* Padlock RNG quality factors
*/
enum padlock_quality_factor_t {
/* Lowest quality: Reads 8 bytes */
PADLOCK_QF0 = 0x00,
/* Medium quality: Reads 4 bytes */
PADLOCK_QF1 = 0x01,
/* Better quality: Reads 2 bytes */
PADLOCK_QF2 = 0x10,
/* Highest quality: Reads 1 byte */
PADLOCK_QF3 = 0x11,
};
/**
* Private data of an padlock_rng_t object.
*/
struct private_padlock_rng_t {
/**
* Public padlock_rng_t interface.
*/
padlock_rng_t public;
/**
* Padlock quality factor
*/
padlock_quality_factor_t quality;
};
/**
* Get bytes from Padlock RNG. buf should have space for (len + 7)
*/
static void rng(char *buf, int len, int quality)
{
while (len > 0)
{
int status;
/* run XSTORE until we have all bytes needed. We do not use REP, as
* this should not be performance critical and it's easier this way. */
asm volatile (
".byte 0x0F,0xA7,0xC0 \n\t"
: "=D"(buf), "=a"(status)
: "d"(quality), "D"(buf));
/* bits[0..4] of status word contains the number of bytes read */
len -= status & 0x1F;
}
}
METHOD(rng_t, allocate_bytes, bool,
private_padlock_rng_t *this, size_t bytes, chunk_t *chunk)
{
chunk->len = bytes;
/* padlock requires some additional bytes */
chunk->ptr = malloc(bytes + 7);
rng(chunk->ptr, chunk->len, this->quality);
return TRUE;
}
METHOD(rng_t, get_bytes, bool,
private_padlock_rng_t *this, size_t bytes, uint8_t *buffer)
{
chunk_t chunk;
/* Padlock needs a larger buffer than "bytes", we need a new buffer */
allocate_bytes(this, bytes, &chunk);
memcpy(buffer, chunk.ptr, bytes);
chunk_clear(&chunk);
return TRUE;
}
METHOD(rng_t, destroy, void,
private_padlock_rng_t *this)
{
free(this);
}
/*
* Described in header.
*/
padlock_rng_t *padlock_rng_create(rng_quality_t quality)
{
private_padlock_rng_t *this;
INIT(this,
.public = {
.rng = {
.get_bytes = _get_bytes,
.allocate_bytes = _allocate_bytes,
.destroy = _destroy,
},
},
);
/* map RNG quality to Padlock quality factor */
switch (quality)
{
case RNG_WEAK:
this->quality = PADLOCK_QF0;
break;
case RNG_STRONG:
this->quality = PADLOCK_QF1;
break;
case RNG_TRUE:
this->quality = PADLOCK_QF3;
break;
default:
free(this);
return NULL;
}
return &this->public;
}
src/libstrongswan/plugins/padlock/padlock_rng.h
-48
View File
@@ -1,48 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup padlock_rng padlock_rng
* @{ @ingroup padlock_p
*/
#ifndef PADLOCK_RNG_H_
#define PADLOCK_RNG_H_
#include <crypto/rngs/rng.h>
typedef struct padlock_rng_t padlock_rng_t;
/**
* Hardware-RNG based on via Padlock.
*/
struct padlock_rng_t {
/**
* Implements rng_t interface.
*/
rng_t rng;
};
/**
* Create a padlock_rng instance.
*
* @param quality required quality of randomness
* @return created random_rng_t
*/
padlock_rng_t *padlock_rng_create(rng_quality_t quality);
#endif /** PADLOCK_RNG_H_ @}*/
src/libstrongswan/plugins/padlock/padlock_sha1_hasher.c
-163
View File
@@ -1,163 +0,0 @@
/*
* Copyright (C) 2008 Thomas Kallenberg
* Copyright (C) 2008 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <string.h>
#include <arpa/inet.h>
#include "padlock_sha1_hasher.h"
#define PADLOCK_ALIGN __attribute__ ((__aligned__(16)))
typedef struct private_padlock_sha1_hasher_t private_padlock_sha1_hasher_t;
/**
* Private data structure with hashing context.
*/
struct private_padlock_sha1_hasher_t {
/**
* Public interface for this hasher.
*/
padlock_sha1_hasher_t public;
/**
* data collected to hash
*/
chunk_t data;
};
/**
* Invoke the actual padlock sha1() operation
*/
static void padlock_sha1(int len, u_char *in, u_char *out)
{
/* rep xsha1 */
asm volatile (
".byte 0xf3, 0x0f, 0xa6, 0xc8"
: "+S"(in), "+D"(out)
: "c"(len), "a"(0));
}
/**
* sha1() a buffer of data into digest
*/
static void sha1(chunk_t data, uint32_t *digest)
{
uint32_t hash[128] PADLOCK_ALIGN;
hash[0] = 0x67452301;
hash[1] = 0xefcdab89;
hash[2] = 0x98badcfe;
hash[3] = 0x10325476;
hash[4] = 0xc3d2e1f0;
padlock_sha1(data.len, data.ptr, (u_char*)hash);
digest[0] = __builtin_bswap32(hash[0]);
digest[1] = __builtin_bswap32(hash[1]);
digest[2] = __builtin_bswap32(hash[2]);
digest[3] = __builtin_bswap32(hash[3]);
digest[4] = __builtin_bswap32(hash[4]);
}
/**
* append data to the to-be-hashed buffer
*/
static void append_data(private_padlock_sha1_hasher_t *this, chunk_t data)
{
this->data.ptr = realloc(this->data.ptr, this->data.len + data.len);
memcpy(this->data.ptr + this->data.len, data.ptr, data.len);
this->data.len += data.len;
}
METHOD(hasher_t, reset, bool,
private_padlock_sha1_hasher_t *this)
{
chunk_free(&this->data);
return TRUE;
}
METHOD(hasher_t, get_hash, bool,
private_padlock_sha1_hasher_t *this, chunk_t chunk, uint8_t *hash)
{
if (hash)
{
if (this->data.len)
{
append_data(this, chunk);
sha1(this->data, (uint32_t*)hash);
}
else
{ /* hash directly if no previous data found */
sha1(chunk, (uint32_t*)hash);
}
reset(this);
}
else
{
append_data(this, chunk);
}
return TRUE;
}
METHOD(hasher_t, allocate_hash, bool,
private_padlock_sha1_hasher_t *this, chunk_t chunk, chunk_t *hash)
{
if (hash)
{
*hash = chunk_alloc(HASH_SIZE_SHA1);
return get_hash(this, chunk, hash->ptr);
}
return get_hash(this, chunk, NULL);
}
METHOD(hasher_t, get_hash_size, size_t,
private_padlock_sha1_hasher_t *this)
{
return HASH_SIZE_SHA1;
}
METHOD(hasher_t, destroy, void,
private_padlock_sha1_hasher_t *this)
{
free(this->data.ptr);
free(this);
}
/*
* Described in header.
*/
padlock_sha1_hasher_t *padlock_sha1_hasher_create(hash_algorithm_t algo)
{
private_padlock_sha1_hasher_t *this;
if (algo != HASH_SHA1)
{
return NULL;
}
INIT(this,
.public = {
.hasher = {
.get_hash = _get_hash,
.allocate_hash = _allocate_hash,
.get_hash_size = _get_hash_size,
.reset = _reset,
.destroy = _destroy,
},
},
);
return &this->public;
}
src/libstrongswan/plugins/padlock/padlock_sha1_hasher.h
-49
View File
@@ -1,49 +0,0 @@
/*
* Copyright (C) 2008 Thomas Kallenberg
* Copyright (C) 2008 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup padlock_sha1_hasher padlock_sha1_hasher
* @{ @ingroup padlock_p
*/
#ifndef PADLOCK_SHA1_HASHER_H_
#define PADLOCK_SHA1_HASHER_H_
typedef struct padlock_sha1_hasher_t padlock_sha1_hasher_t;
#include <crypto/hashers/hasher.h>
/**
* Implementation of hasher_t interface using the SHA1 algorithm.
*/
struct padlock_sha1_hasher_t {
/**
* Implements hasher_t interface.
*/
hasher_t hasher;
};
/**
* Creates a new sha1_hasher_t.
*
* @param algo algorithm, must be HASH_SHA1
* @return sha1_hasher_t object
*/
padlock_sha1_hasher_t *padlock_sha1_hasher_create(hash_algorithm_t algo);
#endif /** SHA1_HASHER_H_ @}*/
src/libstrongswan/utils/cpu_feature.c
-45
View File
@@ -31,18 +31,6 @@ typedef enum {
CPUID1_ECX_AESNI = (1 << 25),
CPUID1_ECX_AVX = (1 << 28),
CPUID1_ECX_RDRAND = (1 << 30),
/* For CentaurHauls cpuid(0xC0000001) */
CPUIDC1_EDX_RNG_AVAILABLE = (1 << 2),
CPUIDC1_EDX_RNG_ENABLED = (1 << 3),
CPUIDC1_EDX_ACE_AVAILABLE = (1 << 6),
CPUIDC1_EDX_ACE_ENABLED = (1 << 7),
CPUIDC1_EDX_ACE2_AVAILABLE = (1 << 8),
CPUIDC1_EDX_ACE2_ENABLED = (1 << 9),
CPUIDC1_EDX_PHE_AVAILABLE = (1 << 10),
CPUIDC1_EDX_PHE_ENABLED = (1 << 11),
CPUIDC1_EDX_PMM_AVAILABLE = (1 << 12),
CPUIDC1_EDX_PMM_ENABLED = (1 << 13),
} cpuid_flag_t;
/**
@@ -74,30 +62,6 @@ static inline cpu_feature_t f2f(u_int reg, cpuid_flag_t flag, cpu_feature_t f)
return 0;
}
/**
* Get features for a Via "CentaurHauls" CPU
*/
static cpu_feature_t get_via_features()
{
cpu_feature_t f = 0;
u_int a, b, c, d;
cpuid(0xc0000001, &a, &b, &c, &d);
f |= f2f(d, CPUIDC1_EDX_RNG_AVAILABLE, CPU_FEATURE_PADLOCK_RNG_AVAILABLE);
f |= f2f(d, CPUIDC1_EDX_RNG_ENABLED, CPU_FEATURE_PADLOCK_RNG_ENABLED);
f |= f2f(d, CPUIDC1_EDX_ACE_AVAILABLE, CPU_FEATURE_PADLOCK_ACE_AVAILABLE);
f |= f2f(d, CPUIDC1_EDX_ACE_ENABLED, CPU_FEATURE_PADLOCK_ACE_ENABLED);
f |= f2f(d, CPUIDC1_EDX_ACE2_AVAILABLE, CPU_FEATURE_PADLOCK_ACE2_AVAILABLE);
f |= f2f(d, CPUIDC1_EDX_ACE2_ENABLED, CPU_FEATURE_PADLOCK_ACE2_ENABLED);
f |= f2f(d, CPUIDC1_EDX_PHE_AVAILABLE, CPU_FEATURE_PADLOCK_PHE_AVAILABLE);
f |= f2f(d, CPUIDC1_EDX_PHE_ENABLED, CPU_FEATURE_PADLOCK_PHE_ENABLED);
f |= f2f(d, CPUIDC1_EDX_PMM_AVAILABLE, CPU_FEATURE_PADLOCK_PMM_AVAILABLE);
f |= f2f(d, CPUIDC1_EDX_PMM_ENABLED, CPU_FEATURE_PADLOCK_PMM_ENABLED);
return f;
}
/**
* See header.
*/
@@ -126,15 +90,6 @@ cpu_feature_t cpu_feature_get_all()
f |= f2f(c, CPUID1_ECX_AVX, CPU_FEATURE_AVX);
f |= f2f(c, CPUID1_ECX_RDRAND, CPU_FEATURE_RDRAND);
if (streq(vendor, "CentaurHauls"))
{
cpuid(0xc0000000, &a, &b, &c, &d);
/* check Centaur Extended Feature Flags */
if (a >= 0xc0000001)
{
f |= get_via_features();
}
}
return f;
}
src/libstrongswan/utils/cpu_feature.h
-11
View File
@@ -37,17 +37,6 @@ typedef enum {
CPU_FEATURE_RDRAND = (1 << 8),
CPU_FEATURE_AESNI = (1 << 9),
CPU_FEATURE_PCLMULQDQ = (1 << 10),
/** Via Padlock Security features */
CPU_FEATURE_PADLOCK_RNG_AVAILABLE = (1 << 22),
CPU_FEATURE_PADLOCK_RNG_ENABLED = (1 << 23),
CPU_FEATURE_PADLOCK_ACE_AVAILABLE = (1 << 24),
CPU_FEATURE_PADLOCK_ACE_ENABLED = (1 << 25),
CPU_FEATURE_PADLOCK_ACE2_AVAILABLE = (1 << 26),
CPU_FEATURE_PADLOCK_ACE2_ENABLED = (1 << 27),
CPU_FEATURE_PADLOCK_PHE_AVAILABLE = (1 << 28),
CPU_FEATURE_PADLOCK_PHE_ENABLED = (1 << 29),
CPU_FEATURE_PADLOCK_PMM_AVAILABLE = (1 << 30),
CPU_FEATURE_PADLOCK_PMM_ENABLED = (1 << 31),
} cpu_feature_t;
/**