cryptodev: Allow some CIOCCRYPT operations with an empty payload.

[jhb]

Summary

If an operation would generate a MAC output (e.g. for digest operation
or for an AEAD or EtA operation), then an empty payload buffer is
valid. Only reject requests with an empty buffer for "plain" cipher
sessions.

Some of the AES-CCM NIST KAT vectors use an empty payload.

While here, don't advance crp_payload_start for requests that use an
empty payload with an inline IV. (*)

Reported by: [e-mail] (*)
Sponsored by: The FreeBSD Foundation

[jhb]

Similar to D32108. this was triggered by AES-CCM tests via cryptotest.py.

[jhb]

sys/opencrypto/cryptodev.c

839

This is the change I talked about over in D32123 where I had relaxed this requirement for all but CSP_MODE_CIPHER.

I think we could further refine this to check for cop->len == cse->ivsize if cop->iv is NULL.

927–928

In your other review we could perhaps make this conditional on the updated crp_payload_length != 0 if we wanted to keep the assertion in crp_sanity()?

[markj]

sys/opencrypto/cryptodev.c

839

Yes, I think that is necessary.

927–928

I think that's fine. To be clear, the idea is to have this instead:

crp->crp_payload_length -= cse->ivsize;
if (crp->crp_payload_length > 0)
    crp->crp_payload_start += cse->ivsize;

Do you want to just handle this in this review?

[jhb]

• Check for cop->len == cse->ivsize.
• Don't bump payload_start for an empty payload.