FreeBSD/sys/geom/eli/g_eli_integrity.c
/*
 * This is the main function responsible for cryptography (ie. communication
 * with crypto(9) subsystem).
 *
 * BIO_READ:
 *	g_eli_start -> g_eli_auth_read -> g_io_request -> g_eli_read_done -> G_ELI_AUTH_RUN -> g_eli_auth_read_done -> g_io_deliver
 * BIO_WRITE:
 *	g_eli_start -> G_ELI_AUTH_RUN -> g_eli_auth_write_done -> g_io_request -> g_eli_write_done -> g_io_deliver
 */
This is the main function responsible for cryptography  subsystem).


This is the main function responsible for cryptography subsystem ) .
void
g_eli_auth_run(struct g_eli_worker *wr, struct bio *bp)
{
	struct g_eli_softc *sc;
	struct cryptop *crp;
	struct cryptodesc *crde, *crda;
	u_int i, lsec, nsec, data_secsize, decr_secsize, encr_secsize;
	off_t dstoff;
	u_char *p, *data, *auth, *authkey, *plaindata;
	int error;
	G_ELI_LOGREQ(3, bp, "%s", __func__);
	bp->bio_pflags = wr->w_number;
	sc = wr->w_softc;
	decr_secsize = bp->bio_to->sectorsize;
	encr_secsize = LIST_FIRST(&sc->sc_geom->consumer)->provider->sectorsize;
	data_secsize = sc->sc_data_per_sector;
	nsec = bp->bio_length / decr_secsize;
	nsec = (nsec * sc->sc_bytes_per_sector) / encr_secsize;
	lsec = sc->sc_bytes_per_sector / encr_secsize;
	dstoff = (bp->bio_offset / bp->bio_to->sectorsize) * sc->sc_bytes_per_sector;
	auth = NULL;	
	plaindata = bp->bio_data;
	if (bp->bio_cmd == BIO_READ) {
		data = bp->bio_driver2;
		auth = data + encr_secsize * nsec;
		p = auth + sc->sc_alen * nsec;
	} else {
		size_t size;
		size = encr_secsize * nsec;
		size += sizeof(*crp) * nsec;
		size += sizeof(*crde) * nsec;
		size += sizeof(*crda) * nsec;
		size += G_ELI_AUTH_SECKEYLEN * nsec;
		data = malloc(size, M_ELI, M_WAITOK);
		bp->bio_driver2 = data;
		p = data + encr_secsize * nsec;
	}
	bp->bio_inbed = 0;
	bp->bio_children = nsec;
	for (i = 1; i <= nsec; i++, dstoff += encr_secsize) {
		crp = (struct cryptop *)p;	p += sizeof(*crp);
		crde = (struct cryptodesc *)p;	p += sizeof(*crde);
		crda = (struct cryptodesc *)p;	p += sizeof(*crda);
		authkey = (u_char *)p;		p += G_ELI_AUTH_SECKEYLEN;
		data_secsize = sc->sc_data_per_sector;
		if ((i % lsec) == 0)
			data_secsize = decr_secsize % data_secsize;
		if (bp->bio_cmd == BIO_READ) {
			bcopy(data, auth, sc->sc_alen);
			auth += sc->sc_alen;
			bzero(data, sc->sc_alen);
		} else {
			bcopy(plaindata, data + sc->sc_alen, data_secsize);
			plaindata += data_secsize;
		}
		crp->crp_sid = wr->w_sid;
		crp->crp_ilen = sc->sc_alen + data_secsize;
		crp->crp_olen = data_secsize;
		crp->crp_opaque = (void *)bp;
		crp->crp_buf = (void *)data;
		data += encr_secsize;
		crp->crp_flags = CRYPTO_F_CBIFSYNC;
		if (g_eli_batch)
			crp->crp_flags |= CRYPTO_F_BATCH;
		if (bp->bio_cmd == BIO_WRITE) {
			crp->crp_callback = g_eli_auth_write_done;
			crp->crp_desc = crde;
			crde->crd_next = crda;
			crda->crd_next = NULL;
		} else {
			crp->crp_callback = g_eli_auth_read_done;
			crp->crp_desc = crda;
			crda->crd_next = crde;
			crde->crd_next = NULL;
		}
		crde->crd_skip = sc->sc_alen;
		crde->crd_len = data_secsize;
		crde->crd_flags = CRD_F_IV_EXPLICIT | CRD_F_IV_PRESENT;
		if ((sc->sc_flags & G_ELI_FLAG_FIRST_KEY) == 0)
			crde->crd_flags |= CRD_F_KEY_EXPLICIT;
		if (bp->bio_cmd == BIO_WRITE)
			crde->crd_flags |= CRD_F_ENCRYPT;
		crde->crd_alg = sc->sc_ealgo;
		crde->crd_key = g_eli_key_hold(sc, dstoff, encr_secsize);
		crde->crd_klen = sc->sc_ekeylen;
		if (sc->sc_ealgo == CRYPTO_AES_XTS)
			crde->crd_klen <<= 1;
		g_eli_crypto_ivgen(sc, dstoff, crde->crd_iv,
		    sizeof(crde->crd_iv));
		crda->crd_skip = sc->sc_alen;
		crda->crd_len = data_secsize;
		crda->crd_inject = 0;
		crda->crd_flags = CRD_F_KEY_EXPLICIT;
		crda->crd_alg = sc->sc_aalgo;
		g_eli_auth_keygen(sc, dstoff, authkey);
		crda->crd_key = authkey;
		crda->crd_klen = G_ELI_AUTH_SECKEYLEN * 8;
		crp->crp_etype = 0;
		error = crypto_dispatch(crp);
		KASSERT(error == 0, ("crypto_dispatch() failed (error=%d)",
		    error));
	}
}
void g_eli_auth_run ( struct g_eli_worker * wr , struct bio * bp ) { struct g_eli_softc * sc ; struct cryptop * crp ; struct cryptodesc * crde , * crda ; u_int i , lsec , nsec , data_secsize , decr_secsize , encr_secsize ; off_t dstoff ; u_char * p , * data , * auth , * authkey , * plaindata ; int error ; G_ELI_LOGREQ ( 3 , bp , " " , __func__ ) ; bp -> bio_pflags = wr -> w_number ; sc = wr -> w_softc ; decr_secsize = bp -> bio_to -> sectorsize ; encr_secsize = LIST_FIRST ( & sc -> sc_geom -> consumer ) -> provider -> sectorsize ; data_secsize = sc -> sc_data_per_sector ; nsec = bp -> bio_length / decr_secsize ; nsec = ( nsec * sc -> sc_bytes_per_sector ) / encr_secsize ; lsec = sc -> sc_bytes_per_sector / encr_secsize ; dstoff = ( bp -> bio_offset / bp -> bio_to -> sectorsize ) * sc -> sc_bytes_per_sector ; auth = NULL ; plaindata = bp -> bio_data ; if ( bp -> bio_cmd == BIO_READ ) { data = bp -> bio_driver2 ; auth = data + encr_secsize * nsec ; p = auth + sc -> sc_alen * nsec ; } else { size_t size ; size = encr_secsize * nsec ; size += sizeof ( * crp ) * nsec ; size += sizeof ( * crde ) * nsec ; size += sizeof ( * crda ) * nsec ; size += G_ELI_AUTH_SECKEYLEN * nsec ; data = malloc ( size , M_ELI , M_WAITOK ) ; bp -> bio_driver2 = data ; p = data + encr_secsize * nsec ; } bp -> bio_inbed = 0 ; bp -> bio_children = nsec ; for ( i = 1 ; i <= nsec ; i ++ , dstoff += encr_secsize ) { crp = ( struct cryptop * ) p ; p += sizeof ( * crp ) ; crde = ( struct cryptodesc * ) p ; p += sizeof ( * crde ) ; crda = ( struct cryptodesc * ) p ; p += sizeof ( * crda ) ; authkey = ( u_char * ) p ; p += G_ELI_AUTH_SECKEYLEN ; data_secsize = sc -> sc_data_per_sector ; if ( ( i % lsec ) == 0 ) data_secsize = decr_secsize % data_secsize ; if ( bp -> bio_cmd == BIO_READ ) { bcopy ( data , auth , sc -> sc_alen ) ; auth += sc -> sc_alen ; bzero ( data , sc -> sc_alen ) ; } else { bcopy ( plaindata , data + sc -> sc_alen , data_secsize ) ; plaindata += data_secsize ; } crp -> crp_sid = wr -> w_sid ; crp -> crp_ilen = sc -> sc_alen + data_secsize ; crp -> crp_olen = data_secsize ; crp -> crp_opaque = ( void * ) bp ; crp -> crp_buf = ( void * ) data ; data += encr_secsize ; crp -> crp_flags = CRYPTO_F_CBIFSYNC ; if ( g_eli_batch ) crp -> crp_flags |= CRYPTO_F_BATCH ; if ( bp -> bio_cmd == BIO_WRITE ) { crp -> crp_callback = g_eli_auth_write_done ; crp -> crp_desc = crde ; crde -> crd_next = crda ; crda -> crd_next = NULL ; } else { crp -> crp_callback = g_eli_auth_read_done ; crp -> crp_desc = crda ; crda -> crd_next = crde ; crde -> crd_next = NULL ; } crde -> crd_skip = sc -> sc_alen ; crde -> crd_len = data_secsize ; crde -> crd_flags = CRD_F_IV_EXPLICIT | CRD_F_IV_PRESENT ; if ( ( sc -> sc_flags & G_ELI_FLAG_FIRST_KEY ) == 0 ) crde -> crd_flags |= CRD_F_KEY_EXPLICIT ; if ( bp -> bio_cmd == BIO_WRITE ) crde -> crd_flags |= CRD_F_ENCRYPT ; crde -> crd_alg = sc -> sc_ealgo ; crde -> crd_key = g_eli_key_hold ( sc , dstoff , encr_secsize ) ; crde -> crd_klen = sc -> sc_ekeylen ; if ( sc -> sc_ealgo == CRYPTO_AES_XTS ) crde -> crd_klen <<= 1 ; g_eli_crypto_ivgen ( sc , dstoff , crde -> crd_iv , sizeof ( crde -> crd_iv ) ) ; crda -> crd_skip = sc -> sc_alen ; crda -> crd_len = data_secsize ; crda -> crd_inject = 0 ; crda -> crd_flags = CRD_F_KEY_EXPLICIT ; crda -> crd_alg = sc -> sc_aalgo ; g_eli_auth_keygen ( sc , dstoff , authkey ) ; crda -> crd_key = authkey ; crda -> crd_klen = G_ELI_AUTH_SECKEYLEN * 8 ; crp -> crp_etype = 0 ; error = crypto_dispatch ( crp ) ; KASSERT ( error == 0 , ( " " , error ) ) ; } }
This is the main function responsible for cryptography (ie.
This is the main function responsible for cryptography ( ie .
/* Sectorsize of decrypted provider eg. 4096. */ /* The real sectorsize of encrypted provider, eg. 512. */ /* Number of data bytes in one encrypted sector, eg. 480. */ /* Number of sectors from decrypted provider, eg. 2. */ /* Number of sectors from encrypted provider, eg. 18. */ /* Last sector number in every big sector, eg. 9. */ /* Destination offset, used for IV generation. */ /* Silence compiler warning. */ /* Remember read HMAC. */ /* TODO: bzero(9) can be commented out later. */