[gnutls-devel] GnuTLS | Add Linux kernel AF_ALG backend (!1404)

[Read-only notification of GnuTLS library development activities]

Stephan Mueller commented on a discussion on lib/accelerated/afalg.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1404#note_551236000

> -	iov[1].iov_base = plain;
> -	iov[1].iov_len = plain_size;
> +	iov[0].iov_base = (void *)plain;
> +	iov[0].iov_len = (plain_size > outbuflen) ? outbuflen : plain_size;
>  
> -	/* Older kernels require tag space for output. */
> -	if ((auth_size + plain_size) <
> -	    kcapi_aead_outbuflen_dec(ctx->handle, plain_size, auth_size,
> -				     tag_size)) {
> -		iov[2].iov_base = tagtmp;
> -		iov[2].iov_len = tag_size;
> -		iovlen = 3;
> -	}
> -
> -	if (kcapi_aead_stream_op(ctx->handle, iov, iovlen) < 0){
> +	if (kcapi_aead_stream_op(ctx->handle, iov, 1) < 0){

The more I think about it, the more I am unsure why the old code was removed. The kernel returns AAD || CT || Tag as a data buffer. See crypto/algif_aead.c:

/*
         * Copy of AAD from source to destination
         *
         * The AAD is copied to the destination buffer without change. Even
         * when user space uses an in-place cipher operation, the kernel
         * will copy the data as it does not see whether such in-place operation
         * is initiated.
         *
         * To ensure efficiency, the following implementation ensure that the
         * ciphers are invoked to perform a crypto operation in-place. This
         * is achieved by memory management specified as follows.
         */

/*
                 * Decryption operation - To achieve an in-place cipher
                 * operation, the following  SGL structure is used:
                 *
                 * TX SGL: AAD || CT || Tag
                 *          |      |     ^
                 *          | copy |     | Create SGL link.
                 *          v      v     |
                 * RX SGL: AAD || CT ----+
                 */

Note, the result of the RX SGL is then returned into the IOVECs provided by the caller.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1404#note_551236000
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20210414/d34fd069/attachment-0001.html>