Makefile: Add security compiling option (RELRO, SC, and FORTIFY)

[platform/upstream/cryptsetup.git] / lib / crypto_backend / pbkdf_check.c

diff --git a/lib/crypto_backend/pbkdf_check.c b/lib/crypto_backend/pbkdf_check.c
index b4c52a9..53a2da9 100644 (file)
--- a/lib/crypto_backend/pbkdf_check.c
+++ b/lib/crypto_backend/pbkdf_check.c
@@ -1,7 +1,7 @@
 /*
  * PBKDF performance check
- * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2012-2021 Milan Broz
+ * Copyright (C) 2012-2023 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2012-2023 Milan Broz
  * Copyright (C) 2016-2020 Ondrej Mosnacek
  *
  * This file is free software; you can redistribute it and/or
@@ -48,6 +48,7 @@ int crypt_pbkdf_get_limits(const char *kdf, struct crypt_pbkdf_limits *limits)
                limits->min_iterations = 1000; /* recommendation in NIST SP 800-132 */
                limits->max_iterations = UINT32_MAX;
                limits->min_memory     = 0; /* N/A */
+               limits->min_bench_memory=0; /* N/A */
                limits->max_memory     = 0; /* N/A */
                limits->min_parallel   = 0; /* N/A */
                limits->max_parallel   = 0; /* N/A */
@@ -55,7 +56,8 @@ int crypt_pbkdf_get_limits(const char *kdf, struct crypt_pbkdf_limits *limits)
        } else if (!strcmp(kdf, "argon2i") || !strcmp(kdf, "argon2id")) {
                limits->min_iterations = 4;
                limits->max_iterations = UINT32_MAX;
-               limits->min_memory     = 32;
+               limits->min_memory     = 32;      /* hard limit */
+               limits->min_bench_memory=64*1024; /* 64 MiB minimum for benchmark */
                limits->max_memory     = 4*1024*1024; /* 4GiB */
                limits->min_parallel   = 1;
                limits->max_parallel   = 4;
@@ -74,7 +76,7 @@ static long time_ms(struct rusage *start, struct rusage *end)
                count_kernel_time = 1;
 
        /*
-        * FIXME: if there is no self usage info, count system time.
+        * If there is no self usage info, count system time.
         * This seem like getrusage() bug in some hypervisors...
         */
        if (!end->ru_utime.tv_sec && !start->ru_utime.tv_sec &&
@@ -408,15 +410,19 @@ int crypt_pbkdf_perf(const char *kdf, const char *hash,
 {
        struct crypt_pbkdf_limits pbkdf_limits;
        int r = -EINVAL;
+       uint32_t min_memory;
 
        if (!kdf || !iterations_out || !memory_out)
                return -EINVAL;
 
-       /* FIXME: whole limits propagation should be more clear here */
        r = crypt_pbkdf_get_limits(kdf, &pbkdf_limits);
        if (r < 0)
                return r;
 
+       min_memory = pbkdf_limits.min_bench_memory;
+       if (min_memory > max_memory_kb)
+               min_memory = max_memory_kb;
+
        *memory_out = 0;
        *iterations_out = 0;
 
@@ -429,7 +435,7 @@ int crypt_pbkdf_perf(const char *kdf, const char *hash,
                r = crypt_argon2_check(kdf, password, password_size,
                                       salt, salt_size, volume_key_size,
                                       pbkdf_limits.min_iterations,
-                                      pbkdf_limits.min_memory,
+                                      min_memory,
                                       max_memory_kb,
                                       parallel_threads, time_ms, iterations_out,
                                       memory_out, progress, usrptr);