in crypto/zcrypt_ep11misc.c [928:1066]
static int ep11_unwrapkey(u16 card, u16 domain,
const u8 *kek, size_t keksize,
const u8 *enckey, size_t enckeysize,
u32 mech, const u8 *iv,
u32 keybitsize, u32 keygenflags,
u8 *keybuf, size_t *keybufsize)
{
struct uw_req_pl {
struct pl_head head;
u8 attr_tag;
u8 attr_len;
u32 attr_header;
u32 attr_bool_mask;
u32 attr_bool_bits;
u32 attr_key_type;
u32 attr_key_type_value;
u32 attr_val_len;
u32 attr_val_len_value;
u8 mech_tag;
u8 mech_len;
u32 mech;
/*
* maybe followed by iv data
* followed by kek tag + kek blob
* followed by empty mac tag
* followed by empty pin tag
* followed by encryted key tag + bytes
*/
} __packed * req_pl;
struct uw_rep_pl {
struct pl_head head;
u8 rc_tag;
u8 rc_len;
u32 rc;
u8 data_tag;
u8 data_lenfmt;
u16 data_len;
u8 data[512];
} __packed * rep_pl;
struct ep11_cprb *req = NULL, *rep = NULL;
struct ep11_target_dev target;
struct ep11_urb *urb = NULL;
struct ep11keyblob *kb;
size_t req_pl_size;
int api, rc = -ENOMEM;
u8 *p;
/* request cprb and payload */
req_pl_size = sizeof(struct uw_req_pl) + (iv ? 16 : 0)
+ ASN1TAGLEN(keksize) + 4 + ASN1TAGLEN(enckeysize);
req = alloc_cprb(req_pl_size);
if (!req)
goto out;
req_pl = (struct uw_req_pl *) (((u8 *) req) + sizeof(*req));
api = (!keygenflags || keygenflags & 0x00200000) ? 4 : 1;
prep_head(&req_pl->head, req_pl_size, api, 34); /* UnwrapKey */
req_pl->attr_tag = 0x04;
req_pl->attr_len = 7 * sizeof(u32);
req_pl->attr_header = 0x10020000;
req_pl->attr_bool_mask = keygenflags ? keygenflags : KEY_ATTR_DEFAULTS;
req_pl->attr_bool_bits = keygenflags ? keygenflags : KEY_ATTR_DEFAULTS;
req_pl->attr_key_type = 0x00000100; /* CKA_KEY_TYPE */
req_pl->attr_key_type_value = 0x0000001f; /* CKK_AES */
req_pl->attr_val_len = 0x00000161; /* CKA_VALUE_LEN */
req_pl->attr_val_len_value = keybitsize / 8;
/* mech is mech + mech params (iv here) */
req_pl->mech_tag = 0x04;
req_pl->mech_len = sizeof(u32) + (iv ? 16 : 0);
req_pl->mech = (mech ? mech : 0x00001085); /* CKM_AES_CBC_PAD */
p = ((u8 *) req_pl) + sizeof(*req_pl);
if (iv) {
memcpy(p, iv, 16);
p += 16;
}
/* kek */
p += asn1tag_write(p, 0x04, kek, keksize);
/* empty mac key tag */
*p++ = 0x04;
*p++ = 0;
/* empty pin tag */
*p++ = 0x04;
*p++ = 0;
/* encrypted key value tag and bytes */
p += asn1tag_write(p, 0x04, enckey, enckeysize);
/* reply cprb and payload */
rep = alloc_cprb(sizeof(struct uw_rep_pl));
if (!rep)
goto out;
rep_pl = (struct uw_rep_pl *) (((u8 *) rep) + sizeof(*rep));
/* urb and target */
urb = kmalloc(sizeof(struct ep11_urb), GFP_KERNEL);
if (!urb)
goto out;
target.ap_id = card;
target.dom_id = domain;
prep_urb(urb, &target, 1,
req, sizeof(*req) + req_pl_size,
rep, sizeof(*rep) + sizeof(*rep_pl));
rc = zcrypt_send_ep11_cprb(urb);
if (rc) {
DEBUG_ERR(
"%s zcrypt_send_ep11_cprb(card=%d dom=%d) failed, rc=%d\n",
__func__, (int) card, (int) domain, rc);
goto out;
}
rc = check_reply_pl((u8 *)rep_pl, __func__);
if (rc)
goto out;
if (rep_pl->data_tag != 0x04 || rep_pl->data_lenfmt != 0x82) {
DEBUG_ERR("%s unknown reply data format\n", __func__);
rc = -EIO;
goto out;
}
if (rep_pl->data_len > *keybufsize) {
DEBUG_ERR("%s mismatch reply data len / key buffer len\n",
__func__);
rc = -ENOSPC;
goto out;
}
/* copy key blob and set header values */
memcpy(keybuf, rep_pl->data, rep_pl->data_len);
*keybufsize = rep_pl->data_len;
kb = (struct ep11keyblob *) keybuf;
kb->head.type = TOKTYPE_NON_CCA;
kb->head.len = rep_pl->data_len;
kb->head.version = TOKVER_EP11_AES;
kb->head.keybitlen = keybitsize;
out:
kfree(req);
kfree(rep);
kfree(urb);
return rc;
}