Merge master.kernel.org:/home/davem/BK/net-2.5

into home.transmeta.com:/home/torvalds/v2.5/linux

crypto/Kconfig

@@ -82,6 +82,18 @@ config CRYPTO_TWOFISH
 	  See also:
 	  http://www.counterpane.com/twofish.html
 
+config CRYPTO_SERPENT
+	tristate "Serpent cipher algorithm"
+	depends on CRYPTO
+	help
+	  Serpent cipher algorithm, by Anderson, Biham & Knudsen.
+
+	  Keys are allowed to be from 0 to 256 bits in length, in steps
+	  of 8 bits.
+
+	  See also:
+	  http://www.cl.cam.ac.uk/~rja14/serpent.html
+
 config CRYPTO_TEST
 	tristate "Testing module"
 	depends on CRYPTO

crypto/Makefile

@@ -17,6 +17,7 @@ obj-$(CONFIG_CRYPTO_SHA256) += sha256.o
 obj-$(CONFIG_CRYPTO_DES) += des.o
 obj-$(CONFIG_CRYPTO_BLOWFISH) += blowfish.o
 obj-$(CONFIG_CRYPTO_TWOFISH) += twofish.o
+obj-$(CONFIG_CRYPTO_SERPENT) += serpent.o
 
 obj-$(CONFIG_CRYPTO_TEST) += tcrypt.o
 

crypto/serpent.c

+/*
+ * Cryptographic API.
+ *
+ * Serpent Cipher Algorithm.
+ *
+ * Copyright (C) 2002 Dag Arne Osvik <osvik@ii.uib.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <asm/byteorder.h>
+#include <linux/crypto.h>
+
+/* Key is padded to the maximum of 256 bits before round key generation.
+ * Any key length <= 256 bits (32 bytes) is allowed by the algorithm.
+ */
+
+#define SERPENT_MIN_KEY_SIZE		  0
+#define SERPENT_MAX_KEY_SIZE		 32
+#define SERPENT_EXPKEY_WORDS		132
+#define SERPENT_BLOCK_SIZE		 16
+
+#define PHI 0x9e3779b9UL
+#define ROL(x,r) ((x) = ((x) << (r)) | ((x) >> (32-(r))))
+#define ROR(x,r) ((x) = ((x) >> (r)) | ((x) << (32-(r))))
+
+#define keyiter(a,b,c,d,i,j) \
+        b ^= d; b ^= c; b ^= a; b ^= PHI ^ i; ROL(b,11); k[j] = b;
+
+#define loadkeys(x0,x1,x2,x3,i) \
+	x0=k[i]; x1=k[i+1]; x2=k[i+2]; x3=k[i+3];
+
+#define storekeys(x0,x1,x2,x3,i) \
+	k[i]=x0; k[i+1]=x1; k[i+2]=x2; k[i+3]=x3;
+
+#define K(x0,x1,x2,x3,i)				\
+	x3 ^= k[4*(i)+3];        x2 ^= k[4*(i)+2];	\
+	x1 ^= k[4*(i)+1];        x0 ^= k[4*(i)+0];
+
+#define LK(x0,x1,x2,x3,x4,i)				\
+					ROL(x0,13);	\
+	ROL(x2,3);	x1 ^= x0;	x4  = x0 << 3;	\
+	x3 ^= x2;	x1 ^= x2;			\
+	ROL(x1,1);	x3 ^= x4;			\
+	ROL(x3,7);	x4  = x1;			\
+	x0 ^= x1;	x4 <<= 7;	x2 ^= x3;	\
+	x0 ^= x3;	x2 ^= x4;	x3 ^= k[4*i+3];	\
+	x1 ^= k[4*i+1];	ROL(x0,5);	ROL(x2,22);	\
+	x0 ^= k[4*i+0];	x2 ^= k[4*i+2];
+
+#define KL(x0,x1,x2,x3,x4,i)				\
+	x0 ^= k[4*i+0];	x1 ^= k[4*i+1];	x2 ^= k[4*i+2];	\
+	x3 ^= k[4*i+3];	ROR(x0,5);	ROR(x2,22);	\
+	x4 =  x1;	x2 ^= x3;	x0 ^= x3;	\
+	x4 <<= 7;	x0 ^= x1;	ROR(x1,1);	\
+	x2 ^= x4;	ROR(x3,7);	x4 = x0 << 3;	\
+	x1 ^= x0;	x3 ^= x4;	ROR(x0,13);	\
+	x1 ^= x2;	x3 ^= x2;	ROR(x2,3);
+
+#define S0(x0,x1,x2,x3,x4)				\
+					x4  = x3;	\
+	x3 |= x0;	x0 ^= x4;	x4 ^= x2;	\
+	x4 =~ x4;	x3 ^= x1;	x1 &= x0;	\
+	x1 ^= x4;	x2 ^= x0;	x0 ^= x3;	\
+	x4 |= x0;	x0 ^= x2;	x2 &= x1;	\
+	x3 ^= x2;	x1 =~ x1;	x2 ^= x4;	\
+	x1 ^= x2;
+
+#define S1(x0,x1,x2,x3,x4)				\
+					x4  = x1;	\
+	x1 ^= x0;	x0 ^= x3;	x3 =~ x3;	\
+	x4 &= x1;	x0 |= x1;	x3 ^= x2;	\
+	x0 ^= x3;	x1 ^= x3;	x3 ^= x4;	\
+	x1 |= x4;	x4 ^= x2;	x2 &= x0;	\
+	x2 ^= x1;	x1 |= x0;	x0 =~ x0;	\
+	x0 ^= x2;	x4 ^= x1;
+
+#define S2(x0,x1,x2,x3,x4)				\
+					x3 =~ x3;	\
+	x1 ^= x0;	x4  = x0;	x0 &= x2;	\
+	x0 ^= x3;	x3 |= x4;	x2 ^= x1;	\
+	x3 ^= x1;	x1 &= x0;	x0 ^= x2;	\
+	x2 &= x3;	x3 |= x1;	x0 =~ x0;	\
+	x3 ^= x0;	x4 ^= x0;	x0 ^= x2;	\
+	x1 |= x2;
+
+#define S3(x0,x1,x2,x3,x4)				\
+					x4  = x1;	\
+	x1 ^= x3;	x3 |= x0;	x4 &= x0;	\
+	x0 ^= x2;	x2 ^= x1;	x1 &= x3;	\
+	x2 ^= x3;	x0 |= x4;	x4 ^= x3;	\
+	x1 ^= x0;	x0 &= x3;	x3 &= x4;	\
+	x3 ^= x2;	x4 |= x1;	x2 &= x1;	\
+	x4 ^= x3;	x0 ^= x3;	x3 ^= x2;
+
+#define S4(x0,x1,x2,x3,x4)				\
+					x4  = x3;	\
+	x3 &= x0;	x0 ^= x4;			\
+	x3 ^= x2;	x2 |= x4;	x0 ^= x1;	\
+	x4 ^= x3;	x2 |= x0;			\
+	x2 ^= x1;	x1 &= x0;			\
+	x1 ^= x4;	x4 &= x2;	x2 ^= x3;	\
+	x4 ^= x0;	x3 |= x1;	x1 =~ x1;	\
+	x3 ^= x0;
+
+#define S5(x0,x1,x2,x3,x4)				\
+	x4  = x1;	x1 |= x0;			\
+	x2 ^= x1;	x3 =~ x3;	x4 ^= x0;	\
+	x0 ^= x2;	x1 &= x4;	x4 |= x3;	\
+	x4 ^= x0;	x0 &= x3;	x1 ^= x3;	\
+	x3 ^= x2;	x0 ^= x1;	x2 &= x4;	\
+	x1 ^= x2;	x2 &= x0;			\
+	x3 ^= x2;
+
+#define S6(x0,x1,x2,x3,x4)				\
+					x4  = x1;	\
+	x3 ^= x0;	x1 ^= x2;	x2 ^= x0;	\
+	x0 &= x3;	x1 |= x3;	x4 =~ x4;	\
+	x0 ^= x1;	x1 ^= x2;			\
+	x3 ^= x4;	x4 ^= x0;	x2 &= x0;	\
+	x4 ^= x1;	x2 ^= x3;	x3 &= x1;	\
+	x3 ^= x0;	x1 ^= x2;
+
+#define S7(x0,x1,x2,x3,x4)				\
+					x1 =~ x1;	\
+	x4  = x1;	x0 =~ x0;	x1 &= x2;	\
+	x1 ^= x3;	x3 |= x4;	x4 ^= x2;	\
+	x2 ^= x3;	x3 ^= x0;	x0 |= x1;	\
+	x2 &= x0;	x0 ^= x4;	x4 ^= x3;	\
+	x3 &= x0;	x4 ^= x1;			\
+	x2 ^= x4;	x3 ^= x1;	x4 |= x0;	\
+	x4 ^= x1;
+
+#define SI0(x0,x1,x2,x3,x4)				\
+			x4  = x3;	x1 ^= x0;	\
+	x3 |= x1;	x4 ^= x1;	x0 =~ x0;	\
+	x2 ^= x3;	x3 ^= x0;	x0 &= x1;	\
+	x0 ^= x2;	x2 &= x3;	x3 ^= x4;	\
+	x2 ^= x3;	x1 ^= x3;	x3 &= x0;	\
+	x1 ^= x0;	x0 ^= x2;	x4 ^= x3;
+
+#define SI1(x0,x1,x2,x3,x4)				\
+	x1 ^= x3;	x4  = x0;			\
+	x0 ^= x2;	x2 =~ x2;	x4 |= x1;	\
+	x4 ^= x3;	x3 &= x1;	x1 ^= x2;	\
+	x2 &= x4;	x4 ^= x1;	x1 |= x3;	\
+	x3 ^= x0;	x2 ^= x0;	x0 |= x4;	\
+	x2 ^= x4;	x1 ^= x0;			\
+	x4 ^= x1;
+
+#define SI2(x0,x1,x2,x3,x4)				\
+	x2 ^= x1;	x4  = x3;	x3 =~ x3;	\
+	x3 |= x2;	x2 ^= x4;	x4 ^= x0;	\
+	x3 ^= x1;	x1 |= x2;	x2 ^= x0;	\
+	x1 ^= x4;	x4 |= x3;	x2 ^= x3;	\
+	x4 ^= x2;	x2 &= x1;			\
+	x2 ^= x3;	x3 ^= x4;	x4 ^= x0;
+
+#define SI3(x0,x1,x2,x3,x4)				\
+					x2 ^= x1;	\
+	x4  = x1;	x1 &= x2;			\
+	x1 ^= x0;	x0 |= x4;	x4 ^= x3;	\
+	x0 ^= x3;	x3 |= x1;	x1 ^= x2;	\
+	x1 ^= x3;	x0 ^= x2;	x2 ^= x3;	\
+	x3 &= x1;	x1 ^= x0;	x0 &= x2;	\
+	x4 ^= x3;	x3 ^= x0;	x0 ^= x1;
+
+#define SI4(x0,x1,x2,x3,x4)				\
+	x2 ^= x3;	x4  = x0;	x0 &= x1;	\
+	x0 ^= x2;	x2 |= x3;	x4 =~ x4;	\
+	x1 ^= x0;	x0 ^= x2;	x2 &= x4;	\
+	x2 ^= x0;	x0 |= x4;			\
+	x0 ^= x3;	x3 &= x2;			\
+	x4 ^= x3;	x3 ^= x1;	x1 &= x0;	\
+	x4 ^= x1;	x0 ^= x3;
+
+#define SI5(x0,x1,x2,x3,x4)				\
+			x4  = x1;	x1 |= x2;	\
+	x2 ^= x4;	x1 ^= x3;	x3 &= x4;	\
+	x2 ^= x3;	x3 |= x0;	x0 =~ x0;	\
+	x3 ^= x2;	x2 |= x0;	x4 ^= x1;	\
+	x2 ^= x4;	x4 &= x0;	x0 ^= x1;	\
+	x1 ^= x3;	x0 &= x2;	x2 ^= x3;	\
+	x0 ^= x2;	x2 ^= x4;	x4 ^= x3;
+
+#define SI6(x0,x1,x2,x3,x4)				\
+			x0 ^= x2;			\
+	x4  = x0;	x0 &= x3;	x2 ^= x3;	\
+	x0 ^= x2;	x3 ^= x1;	x2 |= x4;	\
+	x2 ^= x3;	x3 &= x0;	x0 =~ x0;	\
+	x3 ^= x1;	x1 &= x2;	x4 ^= x0;	\
+	x3 ^= x4;	x4 ^= x2;	x0 ^= x1;	\
+	x2 ^= x0;
+
+#define SI7(x0,x1,x2,x3,x4)				\
+	x4  = x3;	x3 &= x0;	x0 ^= x2;	\
+	x2 |= x4;	x4 ^= x1;	x0 =~ x0;	\
+	x1 |= x3;	x4 ^= x0;	x0 &= x2;	\
+	x0 ^= x1;	x1 &= x2;	x3 ^= x2;	\
+	x4 ^= x3;	x2 &= x3;	x3 |= x0;	\
+	x1 ^= x4;	x3 ^= x4;	x4 &= x0;	\
+	x4 ^= x2;
+
+struct serpent_ctx {
+	u8 iv[SERPENT_BLOCK_SIZE];
+	u32 expkey[SERPENT_EXPKEY_WORDS];
+};
+
+static int setkey(void *ctx, const u8 *key, unsigned int keylen, u32 *flags)
+{
+	u32 *k = ((struct serpent_ctx *)ctx)->expkey;
+	u8  *k8 = (u8 *)k;
+	u32 r0,r1,r2,r3,r4;
+	int i;
+
+	if ((keylen < SERPENT_MIN_KEY_SIZE)
+			|| (keylen > SERPENT_MAX_KEY_SIZE))
+	{
+		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+		return -EINVAL;
+	}
+
+	/* Copy key, add padding */
+
+	for (i = 0; i < keylen; ++i)
+		k8[i] = key[i];
+	if (i < SERPENT_MAX_KEY_SIZE)
+		k8[i++] = 1;
+	while (i < SERPENT_MAX_KEY_SIZE)
+		k8[i++] = 0;
+
+	/* Expand key using polynomial */
+
+	r0 = le32_to_cpu(k[3]);
+	r1 = le32_to_cpu(k[4]);
+	r2 = le32_to_cpu(k[5]);
+	r3 = le32_to_cpu(k[6]);
+	r4 = le32_to_cpu(k[7]);
+
+	keyiter(le32_to_cpu(k[0]),r0,r4,r2,0,0);
+	keyiter(le32_to_cpu(k[1]),r1,r0,r3,1,1);
+	keyiter(le32_to_cpu(k[2]),r2,r1,r4,2,2);
+	keyiter(le32_to_cpu(k[3]),r3,r2,r0,3,3);
+	keyiter(le32_to_cpu(k[4]),r4,r3,r1,4,4);
+	keyiter(le32_to_cpu(k[5]),r0,r4,r2,5,5);
+	keyiter(le32_to_cpu(k[6]),r1,r0,r3,6,6);
+	keyiter(le32_to_cpu(k[7]),r2,r1,r4,7,7);
+
+	keyiter(k[  0],r3,r2,r0,  8,  8); keyiter(k[  1],r4,r3,r1,  9,  9);
+	keyiter(k[  2],r0,r4,r2, 10, 10); keyiter(k[  3],r1,r0,r3, 11, 11);
+	keyiter(k[  4],r2,r1,r4, 12, 12); keyiter(k[  5],r3,r2,r0, 13, 13);
+	keyiter(k[  6],r4,r3,r1, 14, 14); keyiter(k[  7],r0,r4,r2, 15, 15);
+	keyiter(k[  8],r1,r0,r3, 16, 16); keyiter(k[  9],r2,r1,r4, 17, 17);
+	keyiter(k[ 10],r3,r2,r0, 18, 18); keyiter(k[ 11],r4,r3,r1, 19, 19);
+	keyiter(k[ 12],r0,r4,r2, 20, 20); keyiter(k[ 13],r1,r0,r3, 21, 21);
+	keyiter(k[ 14],r2,r1,r4, 22, 22); keyiter(k[ 15],r3,r2,r0, 23, 23);
+	keyiter(k[ 16],r4,r3,r1, 24, 24); keyiter(k[ 17],r0,r4,r2, 25, 25);
+	keyiter(k[ 18],r1,r0,r3, 26, 26); keyiter(k[ 19],r2,r1,r4, 27, 27);
+	keyiter(k[ 20],r3,r2,r0, 28, 28); keyiter(k[ 21],r4,r3,r1, 29, 29);
+	keyiter(k[ 22],r0,r4,r2, 30, 30); keyiter(k[ 23],r1,r0,r3, 31, 31);
+
+	k += 50;
+
+	keyiter(k[-26],r2,r1,r4, 32,-18); keyiter(k[-25],r3,r2,r0, 33,-17);
+	keyiter(k[-24],r4,r3,r1, 34,-16); keyiter(k[-23],r0,r4,r2, 35,-15);
+	keyiter(k[-22],r1,r0,r3, 36,-14); keyiter(k[-21],r2,r1,r4, 37,-13);
+	keyiter(k[-20],r3,r2,r0, 38,-12); keyiter(k[-19],r4,r3,r1, 39,-11);
+	keyiter(k[-18],r0,r4,r2, 40,-10); keyiter(k[-17],r1,r0,r3, 41, -9);
+	keyiter(k[-16],r2,r1,r4, 42, -8); keyiter(k[-15],r3,r2,r0, 43, -7);
+	keyiter(k[-14],r4,r3,r1, 44, -6); keyiter(k[-13],r0,r4,r2, 45, -5);
+	keyiter(k[-12],r1,r0,r3, 46, -4); keyiter(k[-11],r2,r1,r4, 47, -3);
+	keyiter(k[-10],r3,r2,r0, 48, -2); keyiter(k[ -9],r4,r3,r1, 49, -1);
+	keyiter(k[ -8],r0,r4,r2, 50,  0); keyiter(k[ -7],r1,r0,r3, 51,  1);
+	keyiter(k[ -6],r2,r1,r4, 52,  2); keyiter(k[ -5],r3,r2,r0, 53,  3);
+	keyiter(k[ -4],r4,r3,r1, 54,  4); keyiter(k[ -3],r0,r4,r2, 55,  5);
+	keyiter(k[ -2],r1,r0,r3, 56,  6); keyiter(k[ -1],r2,r1,r4, 57,  7);
+	keyiter(k[  0],r3,r2,r0, 58,  8); keyiter(k[  1],r4,r3,r1, 59,  9);
+	keyiter(k[  2],r0,r4,r2, 60, 10); keyiter(k[  3],r1,r0,r3, 61, 11);
+	keyiter(k[  4],r2,r1,r4, 62, 12); keyiter(k[  5],r3,r2,r0, 63, 13);
+	keyiter(k[  6],r4,r3,r1, 64, 14); keyiter(k[  7],r0,r4,r2, 65, 15);
+	keyiter(k[  8],r1,r0,r3, 66, 16); keyiter(k[  9],r2,r1,r4, 67, 17);
+	keyiter(k[ 10],r3,r2,r0, 68, 18); keyiter(k[ 11],r4,r3,r1, 69, 19);
+	keyiter(k[ 12],r0,r4,r2, 70, 20); keyiter(k[ 13],r1,r0,r3, 71, 21);
+	keyiter(k[ 14],r2,r1,r4, 72, 22); keyiter(k[ 15],r3,r2,r0, 73, 23);
+	keyiter(k[ 16],r4,r3,r1, 74, 24); keyiter(k[ 17],r0,r4,r2, 75, 25);
+	keyiter(k[ 18],r1,r0,r3, 76, 26); keyiter(k[ 19],r2,r1,r4, 77, 27);
+	keyiter(k[ 20],r3,r2,r0, 78, 28); keyiter(k[ 21],r4,r3,r1, 79, 29);
+	keyiter(k[ 22],r0,r4,r2, 80, 30); keyiter(k[ 23],r1,r0,r3, 81, 31);
+
+	k += 50;
+
+	keyiter(k[-26],r2,r1,r4, 82,-18); keyiter(k[-25],r3,r2,r0, 83,-17);
+	keyiter(k[-24],r4,r3,r1, 84,-16); keyiter(k[-23],r0,r4,r2, 85,-15);
+	keyiter(k[-22],r1,r0,r3, 86,-14); keyiter(k[-21],r2,r1,r4, 87,-13);
+	keyiter(k[-20],r3,r2,r0, 88,-12); keyiter(k[-19],r4,r3,r1, 89,-11);
+	keyiter(k[-18],r0,r4,r2, 90,-10); keyiter(k[-17],r1,r0,r3, 91, -9);
+	keyiter(k[-16],r2,r1,r4, 92, -8); keyiter(k[-15],r3,r2,r0, 93, -7);
+	keyiter(k[-14],r4,r3,r1, 94, -6); keyiter(k[-13],r0,r4,r2, 95, -5);
+	keyiter(k[-12],r1,r0,r3, 96, -4); keyiter(k[-11],r2,r1,r4, 97, -3);
+	keyiter(k[-10],r3,r2,r0, 98, -2); keyiter(k[ -9],r4,r3,r1, 99, -1);
+	keyiter(k[ -8],r0,r4,r2,100,  0); keyiter(k[ -7],r1,r0,r3,101,  1);
+	keyiter(k[ -6],r2,r1,r4,102,  2); keyiter(k[ -5],r3,r2,r0,103,  3);
+	keyiter(k[ -4],r4,r3,r1,104,  4); keyiter(k[ -3],r0,r4,r2,105,  5);
+	keyiter(k[ -2],r1,r0,r3,106,  6); keyiter(k[ -1],r2,r1,r4,107,  7);
+	keyiter(k[  0],r3,r2,r0,108,  8); keyiter(k[  1],r4,r3,r1,109,  9);
+	keyiter(k[  2],r0,r4,r2,110, 10); keyiter(k[  3],r1,r0,r3,111, 11);
+	keyiter(k[  4],r2,r1,r4,112, 12); keyiter(k[  5],r3,r2,r0,113, 13);
+	keyiter(k[  6],r4,r3,r1,114, 14); keyiter(k[  7],r0,r4,r2,115, 15);
+	keyiter(k[  8],r1,r0,r3,116, 16); keyiter(k[  9],r2,r1,r4,117, 17);
+	keyiter(k[ 10],r3,r2,r0,118, 18); keyiter(k[ 11],r4,r3,r1,119, 19);
+	keyiter(k[ 12],r0,r4,r2,120, 20); keyiter(k[ 13],r1,r0,r3,121, 21);
+	keyiter(k[ 14],r2,r1,r4,122, 22); keyiter(k[ 15],r3,r2,r0,123, 23);
+	keyiter(k[ 16],r4,r3,r1,124, 24); keyiter(k[ 17],r0,r4,r2,125, 25);
+	keyiter(k[ 18],r1,r0,r3,126, 26); keyiter(k[ 19],r2,r1,r4,127, 27);
+	keyiter(k[ 20],r3,r2,r0,128, 28); keyiter(k[ 21],r4,r3,r1,129, 29);
+	keyiter(k[ 22],r0,r4,r2,130, 30); keyiter(k[ 23],r1,r0,r3,131, 31);
+
+	/* Apply S-boxes */
+
+	S3(r3,r4,r0,r1,r2); storekeys(r1,r2,r4,r3, 28); loadkeys(r1,r2,r4,r3, 24);
+	S4(r1,r2,r4,r3,r0); storekeys(r2,r4,r3,r0, 24); loadkeys(r2,r4,r3,r0, 20);
+	S5(r2,r4,r3,r0,r1); storekeys(r1,r2,r4,r0, 20); loadkeys(r1,r2,r4,r0, 16);
+	S6(r1,r2,r4,r0,r3); storekeys(r4,r3,r2,r0, 16); loadkeys(r4,r3,r2,r0, 12);
+	S7(r4,r3,r2,r0,r1); storekeys(r1,r2,r0,r4, 12); loadkeys(r1,r2,r0,r4,  8);
+	S0(r1,r2,r0,r4,r3); storekeys(r0,r2,r4,r1,  8); loadkeys(r0,r2,r4,r1,  4);
+	S1(r0,r2,r4,r1,r3); storekeys(r3,r4,r1,r0,  4); loadkeys(r3,r4,r1,r0,  0);
+	S2(r3,r4,r1,r0,r2); storekeys(r2,r4,r3,r0,  0); loadkeys(r2,r4,r3,r0, -4);
+	S3(r2,r4,r3,r0,r1); storekeys(r0,r1,r4,r2, -4); loadkeys(r0,r1,r4,r2, -8);
+	S4(r0,r1,r4,r2,r3); storekeys(r1,r4,r2,r3, -8); loadkeys(r1,r4,r2,r3,-12);
+	S5(r1,r4,r2,r3,r0); storekeys(r0,r1,r4,r3,-12); loadkeys(r0,r1,r4,r3,-16);
+	S6(r0,r1,r4,r3,r2); storekeys(r4,r2,r1,r3,-16); loadkeys(r4,r2,r1,r3,-20);
+	S7(r4,r2,r1,r3,r0); storekeys(r0,r1,r3,r4,-20); loadkeys(r0,r1,r3,r4,-24);
+	S0(r0,r1,r3,r4,r2); storekeys(r3,r1,r4,r0,-24); loadkeys(r3,r1,r4,r0,-28);
+	k -= 50;
+	S1(r3,r1,r4,r0,r2); storekeys(r2,r4,r0,r3, 22); loadkeys(r2,r4,r0,r3, 18);
+	S2(r2,r4,r0,r3,r1); storekeys(r1,r4,r2,r3, 18); loadkeys(r1,r4,r2,r3, 14);
+	S3(r1,r4,r2,r3,r0); storekeys(r3,r0,r4,r1, 14); loadkeys(r3,r0,r4,r1, 10);
+	S4(r3,r0,r4,r1,r2); storekeys(r0,r4,r1,r2, 10); loadkeys(r0,r4,r1,r2,  6);
+	S5(r0,r4,r1,r2,r3); storekeys(r3,r0,r4,r2,  6); loadkeys(r3,r0,r4,r2,  2);
+	S6(r3,r0,r4,r2,r1); storekeys(r4,r1,r0,r2,  2); loadkeys(r4,r1,r0,r2, -2);
+	S7(r4,r1,r0,r2,r3); storekeys(r3,r0,r2,r4, -2); loadkeys(r3,r0,r2,r4, -6);
+	S0(r3,r0,r2,r4,r1); storekeys(r2,r0,r4,r3, -6); loadkeys(r2,r0,r4,r3,-10);
+	S1(r2,r0,r4,r3,r1); storekeys(r1,r4,r3,r2,-10); loadkeys(r1,r4,r3,r2,-14);
+	S2(r1,r4,r3,r2,r0); storekeys(r0,r4,r1,r2,-14); loadkeys(r0,r4,r1,r2,-18);
+	S3(r0,r4,r1,r2,r3); storekeys(r2,r3,r4,r0,-18); loadkeys(r2,r3,r4,r0,-22);
+	k -= 50;
+	S4(r2,r3,r4,r0,r1); storekeys(r3,r4,r0,r1, 28); loadkeys(r3,r4,r0,r1, 24);
+	S5(r3,r4,r0,r1,r2); storekeys(r2,r3,r4,r1, 24); loadkeys(r2,r3,r4,r1, 20);
+	S6(r2,r3,r4,r1,r0); storekeys(r4,r0,r3,r1, 20); loadkeys(r4,r0,r3,r1, 16);
+	S7(r4,r0,r3,r1,r2); storekeys(r2,r3,r1,r4, 16); loadkeys(r2,r3,r1,r4, 12);
+	S0(r2,r3,r1,r4,r0); storekeys(r1,r3,r4,r2, 12); loadkeys(r1,r3,r4,r2,  8);
+	S1(r1,r3,r4,r2,r0); storekeys(r0,r4,r2,r1,  8); loadkeys(r0,r4,r2,r1,  4);
+	S2(r0,r4,r2,r1,r3); storekeys(r3,r4,r0,r1,  4); loadkeys(r3,r4,r0,r1,  0);
+	S3(r3,r4,r0,r1,r2); storekeys(r1,r2,r4,r3,  0);
+
+	return 0;
+}
+
+static void encrypt(void *ctx, u8 *dst, const u8 *src)
+{
+	const u32
+		*k = ((struct serpent_ctx *)ctx)->expkey,
+		*s = (const u32 *)src;
+	u32	*d = (u32 *)dst,
+		r0, r1, r2, r3, r4;
+
+/*
+ * Note: The conversions between u8* and u32* might cause trouble
+ * on architectures with stricter alignment rules than x86
+ */
+
+	r0 = le32_to_cpu(s[0]);
+	r1 = le32_to_cpu(s[1]);
+	r2 = le32_to_cpu(s[2]);
+	r3 = le32_to_cpu(s[3]);
+
+				 K(r0,r1,r2,r3,0);
+	S0(r0,r1,r2,r3,r4);	LK(r2,r1,r3,r0,r4,1);
+	S1(r2,r1,r3,r0,r4);	LK(r4,r3,r0,r2,r1,2);
+	S2(r4,r3,r0,r2,r1);	LK(r1,r3,r4,r2,r0,3);
+	S3(r1,r3,r4,r2,r0);	LK(r2,r0,r3,r1,r4,4);
+	S4(r2,r0,r3,r1,r4);	LK(r0,r3,r1,r4,r2,5);
+	S5(r0,r3,r1,r4,r2);	LK(r2,r0,r3,r4,r1,6);
+	S6(r2,r0,r3,r4,r1);	LK(r3,r1,r0,r4,r2,7);
+	S7(r3,r1,r0,r4,r2);	LK(r2,r0,r4,r3,r1,8);
+	S0(r2,r0,r4,r3,r1);	LK(r4,r0,r3,r2,r1,9);
+	S1(r4,r0,r3,r2,r1);	LK(r1,r3,r2,r4,r0,10);
+	S2(r1,r3,r2,r4,r0);	LK(r0,r3,r1,r4,r2,11);
+	S3(r0,r3,r1,r4,r2);	LK(r4,r2,r3,r0,r1,12);
+	S4(r4,r2,r3,r0,r1);	LK(r2,r3,r0,r1,r4,13);
+	S5(r2,r3,r0,r1,r4);	LK(r4,r2,r3,r1,r0,14);
+	S6(r4,r2,r3,r1,r0);	LK(r3,r0,r2,r1,r4,15);
+	S7(r3,r0,r2,r1,r4);	LK(r4,r2,r1,r3,r0,16);
+	S0(r4,r2,r1,r3,r0);	LK(r1,r2,r3,r4,r0,17);
+	S1(r1,r2,r3,r4,r0);	LK(r0,r3,r4,r1,r2,18);
+	S2(r0,r3,r4,r1,r2);	LK(r2,r3,r0,r1,r4,19);
+	S3(r2,r3,r0,r1,r4);	LK(r1,r4,r3,r2,r0,20);
+	S4(r1,r4,r3,r2,r0);	LK(r4,r3,r2,r0,r1,21);
+	S5(r4,r3,r2,r0,r1);	LK(r1,r4,r3,r0,r2,22);
+	S6(r1,r4,r3,r0,r2);	LK(r3,r2,r4,r0,r1,23);
+	S7(r3,r2,r4,r0,r1);	LK(r1,r4,r0,r3,r2,24);
+	S0(r1,r4,r0,r3,r2);	LK(r0,r4,r3,r1,r2,25);
+	S1(r0,r4,r3,r1,r2);	LK(r2,r3,r1,r0,r4,26);
+	S2(r2,r3,r1,r0,r4);	LK(r4,r3,r2,r0,r1,27);
+	S3(r4,r3,r2,r0,r1);	LK(r0,r1,r3,r4,r2,28);
+	S4(r0,r1,r3,r4,r2);	LK(r1,r3,r4,r2,r0,29);
+	S5(r1,r3,r4,r2,r0);	LK(r0,r1,r3,r2,r4,30);
+	S6(r0,r1,r3,r2,r4);	LK(r3,r4,r1,r2,r0,31);
+	S7(r3,r4,r1,r2,r0);	 K(r0,r1,r2,r3,32);
+
+	d[0] = cpu_to_le32(r0);
+	d[1] = cpu_to_le32(r1);
+	d[2] = cpu_to_le32(r2);
+	d[3] = cpu_to_le32(r3);
+}
+
+static void decrypt(void *ctx, u8 *dst, const u8 *src)
+{
+	const u32
+		*k = ((struct serpent_ctx *)ctx)->expkey,
+		*s = (const u32 *)src;
+	u32	*d = (u32 *)dst,
+		r0, r1, r2, r3, r4;
+
+	r0 = le32_to_cpu(s[0]);
+	r1 = le32_to_cpu(s[1]);
+	r2 = le32_to_cpu(s[2]);
+	r3 = le32_to_cpu(s[3]);
+
+				K(r0,r1,r2,r3,32);
+	SI7(r0,r1,r2,r3,r4);	KL(r1,r3,r0,r4,r2,31);
+	SI6(r1,r3,r0,r4,r2);	KL(r0,r2,r4,r1,r3,30);
+	SI5(r0,r2,r4,r1,r3);	KL(r2,r3,r0,r4,r1,29);
+	SI4(r2,r3,r0,r4,r1);	KL(r2,r0,r1,r4,r3,28);
+	SI3(r2,r0,r1,r4,r3);	KL(r1,r2,r3,r4,r0,27);
+	SI2(r1,r2,r3,r4,r0);	KL(r2,r0,r4,r3,r1,26);
+	SI1(r2,r0,r4,r3,r1);	KL(r1,r0,r4,r3,r2,25);
+	SI0(r1,r0,r4,r3,r2);	KL(r4,r2,r0,r1,r3,24);
+	SI7(r4,r2,r0,r1,r3);	KL(r2,r1,r4,r3,r0,23);
+	SI6(r2,r1,r4,r3,r0);	KL(r4,r0,r3,r2,r1,22);
+	SI5(r4,r0,r3,r2,r1);	KL(r0,r1,r4,r3,r2,21);
+	SI4(r0,r1,r4,r3,r2);	KL(r0,r4,r2,r3,r1,20);
+	SI3(r0,r4,r2,r3,r1);	KL(r2,r0,r1,r3,r4,19);
+	SI2(r2,r0,r1,r3,r4);	KL(r0,r4,r3,r1,r2,18);
+	SI1(r0,r4,r3,r1,r2);	KL(r2,r4,r3,r1,r0,17);
+	SI0(r2,r4,r3,r1,r0);	KL(r3,r0,r4,r2,r1,16);
+	SI7(r3,r0,r4,r2,r1);	KL(r0,r2,r3,r1,r4,15);
+	SI6(r0,r2,r3,r1,r4);	KL(r3,r4,r1,r0,r2,14);
+	SI5(r3,r4,r1,r0,r2);	KL(r4,r2,r3,r1,r0,13);
+	SI4(r4,r2,r3,r1,r0);	KL(r4,r3,r0,r1,r2,12);
+	SI3(r4,r3,r0,r1,r2);	KL(r0,r4,r2,r1,r3,11);
+	SI2(r0,r4,r2,r1,r3);	KL(r4,r3,r1,r2,r0,10);
+	SI1(r4,r3,r1,r2,r0);	KL(r0,r3,r1,r2,r4,9);
+	SI0(r0,r3,r1,r2,r4);	KL(r1,r4,r3,r0,r2,8);
+	SI7(r1,r4,r3,r0,r2);	KL(r4,r0,r1,r2,r3,7);
+	SI6(r4,r0,r1,r2,r3);	KL(r1,r3,r2,r4,r0,6);
+	SI5(r1,r3,r2,r4,r0);	KL(r3,r0,r1,r2,r4,5);
+	SI4(r3,r0,r1,r2,r4);	KL(r3,r1,r4,r2,r0,4);
+	SI3(r3,r1,r4,r2,r0);	KL(r4,r3,r0,r2,r1,3);
+	SI2(r4,r3,r0,r2,r1);	KL(r3,r1,r2,r0,r4,2);
+	SI1(r3,r1,r2,r0,r4);	KL(r4,r1,r2,r0,r3,1);
+	SI0(r4,r1,r2,r0,r3);	K(r2,r3,r1,r4,0);
+
+	d[0] = cpu_to_le32(r2);
+	d[1] = cpu_to_le32(r3);
+	d[2] = cpu_to_le32(r1);
+	d[3] = cpu_to_le32(r4);
+}
+
+static struct crypto_alg serpent_alg = {
+	.cra_name		=	"serpent",
+	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
+	.cra_blocksize		=	SERPENT_BLOCK_SIZE,
+	.cra_ctxsize		=	sizeof(struct serpent_ctx),
+	.cra_module		=	THIS_MODULE,
+	.cra_list		=	LIST_HEAD_INIT(serpent_alg.cra_list),
+	.cra_u			=	{ .cipher = {
+	.cia_min_keysize	=	SERPENT_MIN_KEY_SIZE,
+	.cia_max_keysize	=	SERPENT_MAX_KEY_SIZE,
+	.cia_ivsize		=	SERPENT_BLOCK_SIZE,
+	.cia_setkey   		= 	setkey,
+	.cia_encrypt 		=	encrypt,
+	.cia_decrypt  		=	decrypt } }
+};
+
+static int __init init(void)
+{
+	return crypto_register_alg(&serpent_alg);
+}
+
+static void __exit fini(void)
+{
+	crypto_unregister_alg(&serpent_alg);
+}
+
+module_init(init);
+module_exit(fini);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Serpent Cipher Algorithm");
+MODULE_AUTHOR("Dag Arne Osvik <osvik@ii.uib.no>");

crypto/tcrypt.c

@@ -48,7 +48,7 @@ static char *tvmem;
 
 static char *check[] = {
 	"des", "md5", "des3_ede", "rot13", "sha1", "sha256", "blowfish",
-	"twofish",
+	"twofish", "serpent",
 	 NULL
 };
 
@@ -1884,6 +1884,105 @@ test_twofish(void)
 	crypto_free_tfm(tfm);
 }
 
+void
+test_serpent(void)
+{
+	unsigned int ret, i, tsize;
+	u8 *p, *q, *key;
+	struct crypto_tfm *tfm;
+	struct serpent_tv *serp_tv;
+	struct scatterlist sg[1];
+
+	printk("\ntesting serpent encryption\n");
+
+	tfm = crypto_alloc_tfm("serpent", 0);
+	if (tfm == NULL) {
+		printk("failed to load transform for serpent (default ecb)\n");
+		return;
+	}
+
+	tsize = sizeof (serpent_enc_tv_template);
+	if (tsize > TVMEMSIZE) {
+		printk("template (%u) too big for tvmem (%u)\n", tsize,
+		       TVMEMSIZE);
+		return;
+	}
+
+	memcpy(tvmem, serpent_enc_tv_template, tsize);
+	serp_tv = (void *) tvmem;
+	for (i = 0; i < SERPENT_ENC_TEST_VECTORS; i++) {
+		printk("test %u (%d bit key):\n", i + 1, serp_tv[i].keylen * 8);
+		key = serp_tv[i].key;
+
+		ret = crypto_cipher_setkey(tfm, key, serp_tv[i].keylen);
+		if (ret) {
+			printk("setkey() failed flags=%x\n", tfm->crt_flags);
+
+			if (!serp_tv[i].fail)
+				goto out;
+		}
+
+		p = serp_tv[i].plaintext;
+		sg[0].page = virt_to_page(p);
+		sg[0].offset = ((long) p & ~PAGE_MASK);
+		sg[0].length = sizeof(serp_tv[i].plaintext);
+		ret = crypto_cipher_encrypt(tfm, sg, 1);
+		if (ret) {
+			printk("encrypt() failed flags=%x\n", tfm->crt_flags);
+			goto out;
+		}
+
+		q = kmap(sg[0].page) + sg[0].offset;
+		hexdump(q, sizeof(serp_tv[i].result));
+
+		printk("%s\n", memcmp(q, serp_tv[i].result,
+			sizeof(serp_tv[i].result)) ? "fail" : "pass");
+	}
+
+	printk("\ntesting serpent decryption\n");
+
+	tsize = sizeof (serpent_dec_tv_template);
+	if (tsize > TVMEMSIZE) {
+		printk("template (%u) too big for tvmem (%u)\n", tsize,
+		       TVMEMSIZE);
+		return;
+	}
+
+	memcpy(tvmem, serpent_dec_tv_template, tsize);
+	serp_tv = (void *) tvmem;
+	for (i = 0; i < SERPENT_DEC_TEST_VECTORS; i++) {
+		printk("test %u (%d bit key):\n", i + 1, serp_tv[i].keylen * 8);
+		key = serp_tv[i].key;
+
+		ret = crypto_cipher_setkey(tfm, key, serp_tv[i].keylen);
+		if (ret) {
+			printk("setkey() failed flags=%x\n", tfm->crt_flags);
+
+			if (!serp_tv[i].fail)
+				goto out;
+		}
+
+		p = serp_tv[i].plaintext;
+		sg[0].page = virt_to_page(p);
+		sg[0].offset = ((long) p & ~PAGE_MASK);
+		sg[0].length = sizeof(serp_tv[i].plaintext);
+		ret = crypto_cipher_decrypt(tfm, sg, 1);
+		if (ret) {
+			printk("decrypt() failed flags=%x\n", tfm->crt_flags);
+			goto out;
+		}
+
+		q = kmap(sg[0].page) + sg[0].offset;
+		hexdump(q, sizeof(serp_tv[i].result));
+
+		printk("%s\n", memcmp(q, serp_tv[i].result,
+			sizeof(serp_tv[i].result)) ? "fail" : "pass");
+	}
+
+out:
+	crypto_free_tfm(tfm);
+}
+
 static void
 test_available(void)
 {
@@ -1911,6 +2010,7 @@ do_test(void)
 		test_sha256();
 		test_blowfish();
 		test_twofish();
+		test_serpent();
 #ifdef CONFIG_CRYPTO_HMAC
 		test_hmac_md5();
 		test_hmac_sha1();
@@ -1950,6 +2050,10 @@ do_test(void)
 		test_twofish();
 		break;
 
+	case 9:
+		test_serpent();
+		break;
+
 #ifdef CONFIG_CRYPTO_HMAC
 	case 100:
 		test_hmac_md5();

crypto/tcrypt.h

@@ -1384,4 +1384,100 @@ struct tf_tv tf_cbc_dec_tv_template[] = {
 	},
 };
 
+/*
+ * Serpent test vectors.  These are backwards because Serpent writes
+ * octect sequences in right-to-left mode.
+ */
+#define SERPENT_ENC_TEST_VECTORS	4
+#define SERPENT_DEC_TEST_VECTORS	4
+
+struct serpent_tv {
+	unsigned int keylen, fail;
+	u8 key[32], plaintext[16], result[16];
+};
+
+struct serpent_tv serpent_enc_tv_template[] = 
+{
+	{
+		0, 0,
+		{ 0 },
+		{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+		  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
+		{ 0x12, 0x07, 0xfc, 0xce, 0x9b, 0xd0, 0xd6, 0x47,
+		  0x6a, 0xe9, 0x8f, 0xbe, 0xd1, 0x43, 0xa0, 0xe2 }
+	},
+	{
+		16, 0,
+		{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+		  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
+		{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+		  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
+		{ 0x4c, 0x7d, 0x8a, 0x32, 0x80, 0x72, 0xa2, 0x2c,
+		  0x82, 0x3e, 0x4a, 0x1f, 0x3a, 0xcd, 0xa1, 0x6d }
+	},
+	{
+		32, 0,
+		{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+		  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+		  0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+		  0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f },
+		{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+		  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
+		{ 0xde, 0x26, 0x9f, 0xf8, 0x33, 0xe4, 0x32, 0xb8,
+		  0x5b, 0x2e, 0x88, 0xd2, 0x70, 0x1c, 0xe7, 0x5c }
+	},
+	{
+		16, 0,
+		{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
+		{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+		{ 0xdd, 0xd2, 0x6b, 0x98, 0xa5, 0xff, 0xd8, 0x2c,
+		  0x05, 0x34, 0x5a, 0x9d, 0xad, 0xbf, 0xaf, 0x49}
+	}
+};
+
+struct serpent_tv serpent_dec_tv_template[] = 
+{
+	{
+		0, 0,
+		{ 0 },
+		{ 0x12, 0x07, 0xfc, 0xce, 0x9b, 0xd0, 0xd6, 0x47,
+		  0x6a, 0xe9, 0x8f, 0xbe, 0xd1, 0x43, 0xa0, 0xe2 },
+		{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+		  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
+
+	},
+	{
+		16, 0,
+		{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+		  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
+		{ 0x4c, 0x7d, 0x8a, 0x32, 0x80, 0x72, 0xa2, 0x2c,
+		  0x82, 0x3e, 0x4a, 0x1f, 0x3a, 0xcd, 0xa1, 0x6d },
+		{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+		  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
+	},
+	{
+		32, 0,
+		{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+		  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+		  0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+		  0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f },
+
+		{ 0xde, 0x26, 0x9f, 0xf8, 0x33, 0xe4, 0x32, 0xb8,
+		  0x5b, 0x2e, 0x88, 0xd2, 0x70, 0x1c, 0xe7, 0x5c },
+		{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+		  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
+	},
+	{
+		16, 0,
+		{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
+		{ 0xdd, 0xd2, 0x6b, 0x98, 0xa5, 0xff, 0xd8, 0x2c,
+		  0x05, 0x34, 0x5a, 0x9d, 0xad, 0xbf, 0xaf, 0x49},
+		{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },  
+	}
+};
+
 #endif	/* _CRYPTO_TCRYPT_H */

net/bridge/netfilter/Kconfig

@@ -70,7 +70,7 @@ config BRIDGE_EBT_ARPF
 	  <file:Documentation/modules.txt>.  If unsure, say `N'.
 
 config BRIDGE_EBT_VLANF
-	tristate "ebt: 802.1Q VLAN filter support (EXPERIMENTAL)"
+	tristate "ebt: 802.1Q VLAN filter support"
 	depends on BRIDGE_NF_EBTABLES
 	help
 	  This option adds the 802.1Q vlan match, which allows the filtering of

net/bridge/netfilter/ebt_vlan.c

@@ -25,17 +25,17 @@
 #include <linux/netfilter_bridge/ebt_vlan.h>
 
 static unsigned char debug;
-#define MODULE_VERSION "0.4 (" __DATE__ " " __TIME__ ")"
+#define MODULE_VERSION "0.6"
 
-MODULE_PARM (debug, "0-1b");
-MODULE_PARM_DESC (debug, "debug=1 is turn on debug messages");
-MODULE_AUTHOR ("Nick Fedchik <nick@fedchik.org.ua>");
-MODULE_DESCRIPTION ("802.1Q match module (ebtables extension), v"
-		    MODULE_VERSION);
-MODULE_LICENSE ("GPL");
+MODULE_PARM(debug, "0-1b");
+MODULE_PARM_DESC(debug, "debug=1 is turn on debug messages");
+MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>");
+MODULE_DESCRIPTION("802.1Q match module (ebtables extension), v"
+		   MODULE_VERSION);
+MODULE_LICENSE("GPL");
 
 
-#define DEBUG_MSG(...) if (debug) printk (KERN_DEBUG __FILE__ ":" __VA_ARGS__)
+#define DEBUG_MSG(...) if (debug) printk (KERN_DEBUG "ebt_vlan: " __VA_ARGS__)
 #define INV_FLAG(_inv_flag_) (info->invflags & _inv_flag_) ? "!" : ""
 #define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_
 #define SET_BITMASK(_BIT_MASK_) info->bitmask |= _BIT_MASK_
@@ -59,11 +59,10 @@ MODULE_LICENSE ("GPL");
  * 1 - miss (rule params not acceptable to the parsed frame)
  */
 static int
-ebt_filter_vlan (const struct sk_buff *skb,
-		 const struct net_device *in,
-		 const struct net_device *out,
-		 const void *data,
-		 unsigned int datalen)
+ebt_filter_vlan(const struct sk_buff *skb,
+		const struct net_device *in,
+		const struct net_device *out,
+		const void *data, unsigned int datalen)
 {
 	struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;	/* userspace data */
 	struct vlan_ethhdr *frame = (struct vlan_ethhdr *) skb->mac.raw;	/* Passed tagged frame */
@@ -75,62 +74,35 @@ ebt_filter_vlan (const struct sk_buff *skb,
 
 	/*
 	 * Tag Control Information (TCI) consists of the following elements:
-	 * - User_priority. This field allows the tagged frame to carry user_priority
-	 * information across Bridged LANs in which individual LAN segments may be unable to signal
-	 * priority information (e.g., 802.3/Ethernet segments). 
-	 * The user_priority field is three bits in length, 
-	 * interpreted as a binary number. The user_priority is therefore
-	 * capable of representing eight priority levels, 0 through 7. 
-	 * The use and interpretation of this field is defined in ISO/IEC 15802-3.
-	 * - Canonical Format Indicator (CFI). This field is used,
-	 * in 802.3/Ethernet, to signal the presence or absence
-	 * of a RIF field, and, in combination with the Non-canonical Format Indicator (NCFI) carried
-	 * in the RIF, to signal the bit order of address information carried in the encapsulated
-	 * frame. The Canonical Format Indicator (CFI) is a single bit flag value.
-	 * - VLAN Identifier (VID). This field uniquely identifies the VLAN to
-	 * which the frame belongs. The twelve-bit VLAN Identifier (VID) field 
-	 * uniquely identify the VLAN to which the frame belongs. 
-	 * The VID is encoded as an unsigned binary number. 
+	 * - User_priority. The user_priority field is three bits in length, 
+	 * interpreted as a binary number. 
+	 * - Canonical Format Indicator (CFI). The Canonical Format Indicator 
+	 * (CFI) is a single bit flag value. Currently ignored.
+	 * - VLAN Identifier (VID). The VID is encoded as 
+	 * an unsigned binary number. 
 	 */
-	TCI = ntohs (frame->h_vlan_TCI);
-	id = TCI & 0xFFF;
-	prio = TCI >> 13;
+	TCI = ntohs(frame->h_vlan_TCI);
+	id = TCI & VLAN_VID_MASK;
+	prio = (TCI >> 13) & 0x7;
 	encap = frame->h_vlan_encapsulated_proto;
 
 	/*
-	 * First step is to check is null VLAN ID present
-	 * in the parsed frame
+	 * Checking VLAN Identifier (VID)
 	 */
-	if (!(id)) {
-		/*
-		 * Checking VLAN Identifier (VID)
-		 */
-		if (GET_BITMASK (EBT_VLAN_ID)) {	/* Is VLAN ID parsed? */
-			EXIT_ON_MISMATCH (id, EBT_VLAN_ID);
-			DEBUG_MSG
-			    ("matched rule id=%s%d for frame id=%d\n",
-			     INV_FLAG (EBT_VLAN_ID), info->id, id);
-		}
-	} else {
-		/*
-		 * Checking user_priority
-		 */
-		if (GET_BITMASK (EBT_VLAN_PRIO)) {	/* Is VLAN user_priority parsed? */
-			EXIT_ON_MISMATCH (prio, EBT_VLAN_PRIO);
-			DEBUG_MSG
-			    ("matched rule prio=%s%d for frame prio=%d\n",
-			     INV_FLAG (EBT_VLAN_PRIO), info->prio,
-			     prio);
-		}
+	if (GET_BITMASK(EBT_VLAN_ID)) {	/* Is VLAN ID parsed? */
+		EXIT_ON_MISMATCH(id, EBT_VLAN_ID);
+	}
+	/*
+	 * Checking user_priority
+	 */
+	if (GET_BITMASK(EBT_VLAN_PRIO)) {	/* Is VLAN user_priority parsed? */
+		EXIT_ON_MISMATCH(prio, EBT_VLAN_PRIO);
 	}
 	/*
 	 * Checking Encapsulated Proto (Length/Type) field
 	 */
-	if (GET_BITMASK (EBT_VLAN_ENCAP)) {	/* Is VLAN Encap parsed? */
-		EXIT_ON_MISMATCH (encap, EBT_VLAN_ENCAP);
-		DEBUG_MSG ("matched encap=%s%2.4X for frame encap=%2.4X\n",
-			   INV_FLAG (EBT_VLAN_ENCAP),
-			   ntohs (info->encap), ntohs (encap));
+	if (GET_BITMASK(EBT_VLAN_ENCAP)) {	/* Is VLAN Encap parsed? */
+		EXIT_ON_MISMATCH(encap, EBT_VLAN_ENCAP);
 	}
 	/*
 	 * All possible extension parameters was parsed.
@@ -141,7 +113,7 @@ ebt_filter_vlan (const struct sk_buff *skb,
 
 /*
  * Function description: ebt_vlan_check() is called when userspace 
- * delivers the table to the kernel, 
+ * delivers the table entry to the kernel, 
  * and to check that userspace doesn't give a bad table.
  * Parameters:
  * const char *tablename - table name string
@@ -154,29 +126,29 @@ ebt_filter_vlan (const struct sk_buff *skb,
  * 1 - miss (rule params is out of range, invalid, incompatible, etc.)
  */
 static int
-ebt_check_vlan (const char *tablename,
-		unsigned int hooknr,
-		const struct ebt_entry *e, void *data,
-		unsigned int datalen)
+ebt_check_vlan(const char *tablename,
+	       unsigned int hooknr,
+	       const struct ebt_entry *e, void *data, unsigned int datalen)
 {
 	struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;
 
 	/*
 	 * Parameters buffer overflow check 
 	 */
-	if (datalen != sizeof (struct ebt_vlan_info)) {
+	if (datalen != sizeof(struct ebt_vlan_info)) {
 		DEBUG_MSG
-		    ("params size %d is not eq to ebt_vlan_info (%d)\n",
-		     datalen, sizeof (struct ebt_vlan_info));
+		    ("passed size %d is not eq to ebt_vlan_info (%d)\n",
+		     datalen, sizeof(struct ebt_vlan_info));
 		return -EINVAL;
 	}
 
 	/*
 	 * Is it 802.1Q frame checked?
 	 */
-	if (e->ethproto != __constant_htons (ETH_P_8021Q)) {
-		DEBUG_MSG ("passed entry proto %2.4X is not 802.1Q (8100)\n",
-			   (unsigned short) ntohs (e->ethproto));
+	if (e->ethproto != __constant_htons(ETH_P_8021Q)) {
+		DEBUG_MSG
+		    ("passed entry proto %2.4X is not 802.1Q (8100)\n",
+		     (unsigned short) ntohs(e->ethproto));
 		return -EINVAL;
 	}
 
@@ -185,8 +157,8 @@ ebt_check_vlan (const char *tablename,
 	 * True if even one bit is out of mask
 	 */
 	if (info->bitmask & ~EBT_VLAN_MASK) {
-		DEBUG_MSG ("bitmask %2X is out of mask (%2X)\n",
-			   info->bitmask, EBT_VLAN_MASK);
+		DEBUG_MSG("bitmask %2X is out of mask (%2X)\n",
+			  info->bitmask, EBT_VLAN_MASK);
 		return -EINVAL;
 	}
 
@@ -194,91 +166,62 @@ ebt_check_vlan (const char *tablename,
 	 * Check for inversion flags range 
 	 */
 	if (info->invflags & ~EBT_VLAN_MASK) {
-		DEBUG_MSG ("inversion flags %2X is out of mask (%2X)\n",
-			   info->invflags, EBT_VLAN_MASK);
+		DEBUG_MSG("inversion flags %2X is out of mask (%2X)\n",
+			  info->invflags, EBT_VLAN_MASK);
 		return -EINVAL;
 	}
 
 	/*
 	 * Reserved VLAN ID (VID) values
 	 * -----------------------------
-	 * 0 - The null VLAN ID. Indicates that the tag header contains only user_priority information;
-	 * no VLAN identifier is present in the frame. This VID value shall not be
-	 * configured as a PVID, configured in any Filtering Database entry, or used in any
-	 * Management operation.
-	 * 
-	 * 1 - The default Port VID (PVID) value used for classifying frames on ingress through a Bridge
-	 * Port. The PVID value can be changed by management on a per-Port basis.
-	 * 
-	 * 0x0FFF - Reserved for implementation use. This VID value shall not be configured as a
-	 * PVID or transmitted in a tag header.
-	 * 
-	 * The remaining values of VID are available for general use as VLAN identifiers.
-	 * A Bridge may implement the ability to support less than the full range of VID values; 
-	 * i.e., for a given implementation,
-	 * an upper limit, N, is defined for the VID values supported, where N is less than or equal to 4094.
-	 * All implementations shall support the use of all VID values in the range 0 through their defined maximum
-	 * VID, N.
-	 * 
-	 * For Linux, N = 4094.
+	 * 0 - The null VLAN ID. 
+	 * 1 - The default Port VID (PVID)
+	 * 0x0FFF - Reserved for implementation use. 
+	 * if_vlan.h: VLAN_GROUP_ARRAY_LEN 4096.
 	 */
-	if (GET_BITMASK (EBT_VLAN_ID)) {	/* when vlan-id param was spec-ed */
+	if (GET_BITMASK(EBT_VLAN_ID)) {	/* when vlan-id param was spec-ed */
 		if (!!info->id) {	/* if id!=0 => check vid range */
-			if (info->id > 4094) {	/* check if id > than (0x0FFE) */
+			if (info->id > VLAN_GROUP_ARRAY_LEN) {
 				DEBUG_MSG
-				    ("vlan id %d is out of range (1-4094)\n",
+				    ("id %d is out of range (1-4096)\n",
 				     info->id);
 				return -EINVAL;
 			}
 			/*
 			 * Note: This is valid VLAN-tagged frame point.
-			 * Any value of user_priority are acceptable, but could be ignored
-			 * according to 802.1Q Std.
-			 */
-		} else {
-			/*
-			 * if id=0 (null VLAN ID)  => Check for user_priority range 
-			 */
-			if (GET_BITMASK (EBT_VLAN_PRIO)) {
-				if ((unsigned char) info->prio > 7) {
-					DEBUG_MSG
-					    ("prio %d is out of range (0-7)\n",
-					     info->prio);
-					return -EINVAL;
-				}
-			}
-			/*
-			 * Note2: This is valid priority-tagged frame point
-			 * with null VID field.
+			 * Any value of user_priority are acceptable, 
+			 * but should be ignored according to 802.1Q Std.
+			 * So we just drop the prio flag. 
 			 */
+			info->bitmask &= ~EBT_VLAN_PRIO;
 		}
-	} else {		/* VLAN Id not set */
-		if (GET_BITMASK (EBT_VLAN_PRIO)) {	/* But user_priority is set - abnormal! */
-			info->id = 0;	/* Set null VID (case for Priority-tagged frames) */
-			SET_BITMASK (EBT_VLAN_ID);	/* and set id flag */
+		/*
+		 * Else, id=0 (null VLAN ID)  => user_priority range (any?)
+		 */
+	}
+
+	if (GET_BITMASK(EBT_VLAN_PRIO)) {
+		if ((unsigned char) info->prio > 7) {
+			DEBUG_MSG
+			    ("prio %d is out of range (0-7)\n",
+			     info->prio);
+			return -EINVAL;
 		}
 	}
 	/*
-	 * Check for encapsulated proto range - it is possible to be any value for u_short range.
-	 * When relaying a tagged frame between 802.3/Ethernet MACs, 
-	 * a Bridge may adjust the padding field such that
-	 * the minimum size of a transmitted tagged frame is 68 octets (7.2).
+	 * Check for encapsulated proto range - it is possible to be 
+	 * any value for u_short range.
 	 * if_ether.h:  ETH_ZLEN        60   -  Min. octets in frame sans FCS
 	 */
-	if (GET_BITMASK (EBT_VLAN_ENCAP)) {
-		if ((unsigned short) ntohs (info->encap) < ETH_ZLEN) {
+	if (GET_BITMASK(EBT_VLAN_ENCAP)) {
+		if ((unsigned short) ntohs(info->encap) < ETH_ZLEN) {
 			DEBUG_MSG
-			    ("encap packet length %d is less than minimal %d\n",
-			     ntohs (info->encap), ETH_ZLEN);
+			    ("encap frame length %d is less than minimal\n",
+			     ntohs(info->encap));
 			return -EINVAL;
 		}
 	}
 
-	/*
-	 * Otherwise is all correct 
-	 */
-	DEBUG_MSG ("802.1Q tagged frame checked (%s table, %d hook)\n",
-		   tablename, hooknr);
 	return 0;
 }
 
@@ -293,24 +236,22 @@ static struct ebt_match filter_vlan = {
 
 /*
  * Module initialization function.
- * Called when module is loaded to kernelspace
  */
-static int __init init (void)
+static int __init init(void)
 {
-	DEBUG_MSG ("ebtables 802.1Q extension module v"
-		   MODULE_VERSION "\n");
-	DEBUG_MSG ("module debug=%d\n", !!debug);
-	return ebt_register_match (&filter_vlan);
+	DEBUG_MSG("ebtables 802.1Q extension module v"
+		  MODULE_VERSION "\n");
+	DEBUG_MSG("module debug=%d\n", !!debug);
+	return ebt_register_match(&filter_vlan);
 }
 
 /*
  * Module "finalization" function
- * Called when download module from kernelspace
  */
-static void __exit fini (void)
+static void __exit fini(void)
 {
-	ebt_unregister_match (&filter_vlan);
+	ebt_unregister_match(&filter_vlan);
 }
 
-module_init (init);
-module_exit (fini);
+module_init(init);
+module_exit(fini);