[tamnd]

Part of #541 (the AF_ALG item). This is the second of three PRs: the algorithms (#699), then AF_ALG with hash, then AF_ALG with skcipher.

What this does

• The AF_ALG sockets in net/rk-net/src/alg, as crypto/af_alg.c and crypto/algif_hash.c of Linux. rk-net now uses rk-crypto.
  • socket(AF_ALG, SOCK_SEQPACKET, 0) makes the socket. Another type gives ESOCKTNOSUPPORT, and a protocol that is not 0 gives EPROTONOSUPPORT.
  • bind takes a struct sockaddr_alg with the type hash and the name of a hash of rk-crypto, for example sha256 or hmac(sha256). A second bind gives EBUSY. An unknown type or name gives ENOENT.
  • As crypto.af_alg_restrict=1 of Linux 7.3, only the names of the allow list of algif_hash.c can bind. A name that is not in the list gives ENOENT. A name of the list without the flag for all users (for example sha256) gives ENOENT without CAP_SYS_ADMIN or CAP_NET_ADMIN. sha1 and the HMACs of SHA-1 and SHA-2 are for all users.
  • setsockopt(SOL_ALG, ALG_SET_KEY) sets the key of an HMAC. A hash with no key gives ENOSYS. The key goes to the sockets that accept makes later.
  • accept gives the socket of one computation. An HMAC with no key gives ENOKEY at the first send or recv, as hash_accept_nokey of Linux.
  • send and sendmsg add data. With MSG_MORE, the computation continues. Without it, the digest is ready. recv gives the digest, and a short buffer gives the first bytes with MSG_TRUNC. A recv with no data gives the digest of the empty message.
  • accept on the socket of a computation gives a new socket with a copy of the state, as hash_accept of Linux.
• socket(AF_ALG, ...) in rk-syscall goes to the new sockets.

Tests

• cargo fmt --all --check and cargo clippy -p rk-net -p rk-crypto --all-targets: ok.
• cargo test -p rk-net: 122 passed. cargo test -p rk-crypto: 13 passed. The new tests of net/rk-net/src/alg/tests.rs check sha256, hmac(sha256) with the vectors of crypto/testmgr.h, data in more parts with MSG_MORE, the copy of a state with accept, MSG_TRUNC, the errors of bind, setsockopt and accept, and the allow list with and without CAP_SYS_ADMIN. The load average on server2 was 6.65, 5.68, 5.59 at the start and 17.62, 17.32, 14.85 at the end.
• LTP runtest/crypto with the release kernel, 2 CPUs, on x86_64 (server1, load average 0.15 at the start and 2.19 at the end) and arm64 (server2, load average 10.68 at the start and 23.69 at the end):
  • af_alg01 (hmac in hmac on each hash): pass on x86_64 and arm64.
  • af_alg02 (salsa20), af_alg03 (rfc7539), af_alg04 (vmac), af_alg05 (cbc(aes-generic), not in the allow list), af_alg06 and af_alg08 (aead): TCONF on both, as on Linux with the allow list.
  • af_alg07 (the race of dup2 and fchownat on a socket): TFAIL on x86_64, and on arm64 the run did not end in the time limit of 900 s. fchownat with AT_EMPTY_PATH on a socket does not give ENOENT after the release of the socket yet. This comes in a later PR.
  • pcrypt_aead01, crypto_user01 and crypto_user02 (NETLINK_CRYPTO): TCONF on arm64. The x86_64 LTP tree of the test does not have them.

The full gate did not run.