Commit 128cfb88 authored by Tianjia Zhang's avatar Tianjia Zhang Committed by David S. Miller
Browse files

net/tls: support SM4 CCM algorithm 



The IV of CCM mode has special requirements, this patch supports CCM
mode of SM4 algorithm.

Signed-off-by: default avatarTianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1817750b

include/net/tls.h

+2 −1
Original line number Diff line number Diff line
@@ -66,7 +66,7 @@ 
#define MAX_IV_SIZE			16

#define TLS_MAX_REC_SEQ_SIZE		8



/* For AES-CCM, the full 16-bytes of IV is made of '4' fields of given sizes.

/* For CCM mode, the full 16-bytes of IV is made of '4' fields of given sizes.

 *

 * IV[16] = b0[1] || implicit nonce[4] || explicit nonce[8] || length[3]

 *
@@ -74,6 +74,7 @@ 
 * Hence b0 contains (3 - 1) = 2.

 */

#define TLS_AES_CCM_IV_B0_BYTE		2

#define TLS_SM4_CCM_IV_B0_BYTE		2



#define __TLS_INC_STATS(net, field)				\

	__SNMP_INC_STATS((net)->mib.tls_statistics, field)

net/tls/tls_sw.c

+16 −4
Original line number Diff line number Diff line
@@ -498,9 +498,15 @@ static int tls_do_encryption(struct sock *sk, 
	int rc, iv_offset = 0;



	/* For CCM based ciphers, first byte of IV is a constant */

	if (prot->cipher_type == TLS_CIPHER_AES_CCM_128) {

	switch (prot->cipher_type) {

	case TLS_CIPHER_AES_CCM_128:

		rec->iv_data[0] = TLS_AES_CCM_IV_B0_BYTE;

		iv_offset = 1;

		break;

	case TLS_CIPHER_SM4_CCM:

		rec->iv_data[0] = TLS_SM4_CCM_IV_B0_BYTE;

		iv_offset = 1;

		break;

	}



	memcpy(&rec->iv_data[iv_offset], tls_ctx->tx.iv,
@@ -1457,10 +1463,16 @@ static int decrypt_internal(struct sock *sk, struct sk_buff *skb, 
	aad = (u8 *)(sgout + n_sgout);

	iv = aad + prot->aad_size;



	/* For CCM based ciphers, first byte of nonce+iv is always '2' */

	if (prot->cipher_type == TLS_CIPHER_AES_CCM_128) {

		iv[0] = 2;

	/* For CCM based ciphers, first byte of nonce+iv is a constant */

	switch (prot->cipher_type) {

	case TLS_CIPHER_AES_CCM_128:

		iv[0] = TLS_AES_CCM_IV_B0_BYTE;

		iv_offset = 1;

		break;

	case TLS_CIPHER_SM4_CCM:

		iv[0] = TLS_SM4_CCM_IV_B0_BYTE;

		iv_offset = 1;

		break;

	}



	/* Prepare IV */