[tamnd]

Part of #541 (the AF_ALG item). This is the third PR of the item: the algorithms (#699), AF_ALG with hash (#703), and now AF_ALG with skcipher.

What this does

• The operation sockets of the type skcipher in net/rk-net/src/alg/skcipher.rs, as crypto/algif_skcipher.c and the queue functions of crypto/af_alg.c of Linux. The ciphers come from rk-crypto: ecb(aes), cbc(aes), ctr(aes) and xts(aes).
  • bind takes the type skcipher. As crypto.af_alg_restrict=1 of Linux 7.3, only the names of skcipher_allowlist can bind. xts(aes) is for all users. ecb(aes), cbc(aes) and ctr(aes) need CAP_SYS_ADMIN or CAP_NET_ADMIN. Other names give ENOENT.
  • setsockopt(SOL_ALG, ALG_SET_KEY) sets the key. A key with a bad length gives EINVAL. A send or recv before the key gives ENOKEY.
  • sendmsg reads the control messages of the level SOL_ALG: ALG_SET_OP (encrypt or decrypt) and ALG_SET_IV. An IV with a bad length or an unknown operation gives EINVAL. The data goes to the queue of the socket. The queue holds at most the send buffer, and a full queue makes the send wait, or gives EAGAIN with MSG_DONTWAIT.
  • With MSG_MORE, the operation continues in the next send. A recv then takes only full blocks, and the IV goes on to the next recv, as CRYPTO_SKCIPHER_REQ_NOTFINAL. A recv waits for data, or gives EAGAIN with MSG_DONTWAIT.
  • A blocking recv of more bytes than the operation has takes all the data and then waits for a new send, as skcipher_recvmsg of Linux.
  • A new send while the data of an operation that ended waits for a recv gives EINVAL.
  • poll gives POLLIN if no more data comes or the queue has data, and POLLOUT if the queue has space, as af_alg_poll.
  • A send with no control message keeps the operation, and the IV goes on from the last block.
• The bound socket keeps the cipher of the bind, and accept gives an operation socket with a copy of it.

Tests

• cargo fmt --all --check, and cargo clippy --all-targets for rk-net, rk-crypto, rk-syscall and xtask: ok. The clippy warnings are only in files that this PR does not change.
• cargo test for rk-net (128 tests, with the 3 new tests), rk-crypto, rk-syscall and xtask: ok. The tests ran with a time limit of 900 s.
• The new tests of net/rk-net/src/alg/tests.rs:
  • skcipher_cbc: NIST SP 800-38A F.2.1 with cbc(aes), a decryption in two parts with MSG_MORE, a recv in small parts, and the IV of a second operation.
  • skcipher_xts: xts(aes) with whole blocks and with ciphertext stealing (17 and 100 bytes), against rk-crypto, whose vectors come from crypto/testmgr.h.
  • skcipher_errors: ENOENT for names that are not in the allow list, EINVAL for a bad key, a bad IV, a bad operation, an unknown control message, a new operation before the recv and a length that is not a multiple of the block (as af_alg05), ENOKEY, EAGAIN, and poll.
• LTP crypto (af_alg01 to af_alg08, pcrypt_aead01, crypto_user01 and crypto_user02) on x86_64 (server1, load 0.2) and arm64 (server2, load 15 to 18):
  • af_alg01 passes.
  • af_alg02 to af_alg06 and af_alg08 give TCONF, as on Linux 7.3 with the allow list. af_alg05 binds cbc(aes-generic), which is not in the allow list.
  • af_alg07 passes only with the change of the next PR (the owner of the inode of a socket). The kernel of these runs had that change too.
  • pcrypt_aead01, crypto_user01 and crypto_user02 give TCONF on arm64, because NETLINK_CRYPTO is not there. The x86_64 LTP build does not have them.

The full gate did not run.