]>
Commit | Line | Data |
---|---|---|
0adda907 | 1 | /* |
0b81d077 | 2 | * key management facility for FS encryption support. |
0adda907 JK |
3 | * |
4 | * Copyright (C) 2015, Google, Inc. | |
5 | * | |
0b81d077 | 6 | * This contains encryption key functions. |
0adda907 JK |
7 | * |
8 | * Written by Michael Halcrow, Ildar Muslukhov, and Uday Savagaonkar, 2015. | |
9 | */ | |
0b81d077 | 10 | |
0adda907 | 11 | #include <keys/user-type.h> |
0adda907 | 12 | #include <linux/scatterlist.h> |
3325bea5 | 13 | #include "fscrypt_private.h" |
0adda907 JK |
14 | |
15 | static void derive_crypt_complete(struct crypto_async_request *req, int rc) | |
16 | { | |
0b81d077 | 17 | struct fscrypt_completion_result *ecr = req->data; |
0adda907 JK |
18 | |
19 | if (rc == -EINPROGRESS) | |
20 | return; | |
21 | ||
22 | ecr->res = rc; | |
23 | complete(&ecr->completion); | |
24 | } | |
25 | ||
26 | /** | |
0b81d077 | 27 | * derive_key_aes() - Derive a key using AES-128-ECB |
0fac2d50 | 28 | * @deriving_key: Encryption key used for derivation. |
0adda907 JK |
29 | * @source_key: Source key to which to apply derivation. |
30 | * @derived_key: Derived key. | |
31 | * | |
32 | * Return: Zero on success; non-zero otherwise. | |
33 | */ | |
0b81d077 JK |
34 | static int derive_key_aes(u8 deriving_key[FS_AES_128_ECB_KEY_SIZE], |
35 | u8 source_key[FS_AES_256_XTS_KEY_SIZE], | |
36 | u8 derived_key[FS_AES_256_XTS_KEY_SIZE]) | |
0adda907 JK |
37 | { |
38 | int res = 0; | |
d407574e | 39 | struct skcipher_request *req = NULL; |
0b81d077 | 40 | DECLARE_FS_COMPLETION_RESULT(ecr); |
0adda907 | 41 | struct scatterlist src_sg, dst_sg; |
d407574e | 42 | struct crypto_skcipher *tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0); |
0adda907 JK |
43 | |
44 | if (IS_ERR(tfm)) { | |
45 | res = PTR_ERR(tfm); | |
46 | tfm = NULL; | |
47 | goto out; | |
48 | } | |
d407574e LT |
49 | crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_WEAK_KEY); |
50 | req = skcipher_request_alloc(tfm, GFP_NOFS); | |
0adda907 JK |
51 | if (!req) { |
52 | res = -ENOMEM; | |
53 | goto out; | |
54 | } | |
d407574e | 55 | skcipher_request_set_callback(req, |
0adda907 JK |
56 | CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, |
57 | derive_crypt_complete, &ecr); | |
d407574e | 58 | res = crypto_skcipher_setkey(tfm, deriving_key, |
0b81d077 | 59 | FS_AES_128_ECB_KEY_SIZE); |
0adda907 JK |
60 | if (res < 0) |
61 | goto out; | |
62 | ||
0b81d077 JK |
63 | sg_init_one(&src_sg, source_key, FS_AES_256_XTS_KEY_SIZE); |
64 | sg_init_one(&dst_sg, derived_key, FS_AES_256_XTS_KEY_SIZE); | |
d407574e | 65 | skcipher_request_set_crypt(req, &src_sg, &dst_sg, |
0b81d077 | 66 | FS_AES_256_XTS_KEY_SIZE, NULL); |
d407574e | 67 | res = crypto_skcipher_encrypt(req); |
0adda907 | 68 | if (res == -EINPROGRESS || res == -EBUSY) { |
0adda907 JK |
69 | wait_for_completion(&ecr.completion); |
70 | res = ecr.res; | |
71 | } | |
72 | out: | |
d407574e LT |
73 | skcipher_request_free(req); |
74 | crypto_free_skcipher(tfm); | |
0adda907 JK |
75 | return res; |
76 | } | |
77 | ||
b5a7aef1 JK |
78 | static int validate_user_key(struct fscrypt_info *crypt_info, |
79 | struct fscrypt_context *ctx, u8 *raw_key, | |
a5d431ef | 80 | const char *prefix) |
b5a7aef1 | 81 | { |
a5d431ef | 82 | char *description; |
b5a7aef1 JK |
83 | struct key *keyring_key; |
84 | struct fscrypt_key *master_key; | |
85 | const struct user_key_payload *ukp; | |
b5a7aef1 JK |
86 | int res; |
87 | ||
a5d431ef EB |
88 | description = kasprintf(GFP_NOFS, "%s%*phN", prefix, |
89 | FS_KEY_DESCRIPTOR_SIZE, | |
90 | ctx->master_key_descriptor); | |
91 | if (!description) | |
b5a7aef1 JK |
92 | return -ENOMEM; |
93 | ||
a5d431ef EB |
94 | keyring_key = request_key(&key_type_logon, description, NULL); |
95 | kfree(description); | |
b5a7aef1 JK |
96 | if (IS_ERR(keyring_key)) |
97 | return PTR_ERR(keyring_key); | |
98 | ||
99 | if (keyring_key->type != &key_type_logon) { | |
100 | printk_once(KERN_WARNING | |
101 | "%s: key type must be logon\n", __func__); | |
102 | res = -ENOKEY; | |
103 | goto out; | |
104 | } | |
105 | down_read(&keyring_key->sem); | |
0837e49a | 106 | ukp = user_key_payload_locked(keyring_key); |
b5a7aef1 JK |
107 | if (ukp->datalen != sizeof(struct fscrypt_key)) { |
108 | res = -EINVAL; | |
109 | up_read(&keyring_key->sem); | |
110 | goto out; | |
111 | } | |
112 | master_key = (struct fscrypt_key *)ukp->data; | |
113 | BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE != FS_KEY_DERIVATION_NONCE_SIZE); | |
114 | ||
115 | if (master_key->size != FS_AES_256_XTS_KEY_SIZE) { | |
116 | printk_once(KERN_WARNING | |
117 | "%s: key size incorrect: %d\n", | |
118 | __func__, master_key->size); | |
119 | res = -ENOKEY; | |
120 | up_read(&keyring_key->sem); | |
121 | goto out; | |
122 | } | |
123 | res = derive_key_aes(ctx->nonce, master_key->raw, raw_key); | |
124 | up_read(&keyring_key->sem); | |
125 | if (res) | |
126 | goto out; | |
127 | ||
128 | crypt_info->ci_keyring_key = keyring_key; | |
129 | return 0; | |
130 | out: | |
131 | key_put(keyring_key); | |
132 | return res; | |
133 | } | |
134 | ||
8f39850d EB |
135 | static int determine_cipher_type(struct fscrypt_info *ci, struct inode *inode, |
136 | const char **cipher_str_ret, int *keysize_ret) | |
137 | { | |
138 | if (S_ISREG(inode->i_mode)) { | |
139 | if (ci->ci_data_mode == FS_ENCRYPTION_MODE_AES_256_XTS) { | |
140 | *cipher_str_ret = "xts(aes)"; | |
141 | *keysize_ret = FS_AES_256_XTS_KEY_SIZE; | |
142 | return 0; | |
143 | } | |
144 | pr_warn_once("fscrypto: unsupported contents encryption mode " | |
145 | "%d for inode %lu\n", | |
146 | ci->ci_data_mode, inode->i_ino); | |
147 | return -ENOKEY; | |
148 | } | |
149 | ||
150 | if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) { | |
151 | if (ci->ci_filename_mode == FS_ENCRYPTION_MODE_AES_256_CTS) { | |
152 | *cipher_str_ret = "cts(cbc(aes))"; | |
153 | *keysize_ret = FS_AES_256_CTS_KEY_SIZE; | |
154 | return 0; | |
155 | } | |
156 | pr_warn_once("fscrypto: unsupported filenames encryption mode " | |
157 | "%d for inode %lu\n", | |
158 | ci->ci_filename_mode, inode->i_ino); | |
159 | return -ENOKEY; | |
160 | } | |
161 | ||
162 | pr_warn_once("fscrypto: unsupported file type %d for inode %lu\n", | |
163 | (inode->i_mode & S_IFMT), inode->i_ino); | |
164 | return -ENOKEY; | |
165 | } | |
166 | ||
0b81d077 | 167 | static void put_crypt_info(struct fscrypt_info *ci) |
0adda907 | 168 | { |
0adda907 JK |
169 | if (!ci) |
170 | return; | |
171 | ||
d407574e LT |
172 | key_put(ci->ci_keyring_key); |
173 | crypto_free_skcipher(ci->ci_ctfm); | |
0b81d077 | 174 | kmem_cache_free(fscrypt_info_cachep, ci); |
0adda907 JK |
175 | } |
176 | ||
3325bea5 | 177 | int fscrypt_get_crypt_info(struct inode *inode) |
0adda907 | 178 | { |
0b81d077 | 179 | struct fscrypt_info *crypt_info; |
0b81d077 | 180 | struct fscrypt_context ctx; |
d407574e | 181 | struct crypto_skcipher *ctfm; |
26bf3dc7 | 182 | const char *cipher_str; |
8f39850d | 183 | int keysize; |
a6e08912 | 184 | u8 *raw_key = NULL; |
0adda907 JK |
185 | int res; |
186 | ||
f32d7ac2 | 187 | res = fscrypt_initialize(inode->i_sb->s_cop->flags); |
cfc4d971 JK |
188 | if (res) |
189 | return res; | |
0b81d077 JK |
190 | |
191 | if (!inode->i_sb->s_cop->get_context) | |
192 | return -EOPNOTSUPP; | |
26bf3dc7 | 193 | retry: |
0b81d077 | 194 | crypt_info = ACCESS_ONCE(inode->i_crypt_info); |
26bf3dc7 JK |
195 | if (crypt_info) { |
196 | if (!crypt_info->ci_keyring_key || | |
197 | key_validate(crypt_info->ci_keyring_key) == 0) | |
0adda907 | 198 | return 0; |
0b81d077 | 199 | fscrypt_put_encryption_info(inode, crypt_info); |
26bf3dc7 | 200 | goto retry; |
0adda907 JK |
201 | } |
202 | ||
0b81d077 JK |
203 | res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); |
204 | if (res < 0) { | |
5bbdcbbb TT |
205 | if (!fscrypt_dummy_context_enabled(inode) || |
206 | inode->i_sb->s_cop->is_encrypted(inode)) | |
0b81d077 | 207 | return res; |
5bbdcbbb TT |
208 | /* Fake up a context for an unencrypted directory */ |
209 | memset(&ctx, 0, sizeof(ctx)); | |
8f39850d | 210 | ctx.format = FS_ENCRYPTION_CONTEXT_FORMAT_V1; |
0b81d077 JK |
211 | ctx.contents_encryption_mode = FS_ENCRYPTION_MODE_AES_256_XTS; |
212 | ctx.filenames_encryption_mode = FS_ENCRYPTION_MODE_AES_256_CTS; | |
5bbdcbbb | 213 | memset(ctx.master_key_descriptor, 0x42, FS_KEY_DESCRIPTOR_SIZE); |
0b81d077 | 214 | } else if (res != sizeof(ctx)) { |
0adda907 | 215 | return -EINVAL; |
0b81d077 | 216 | } |
8f39850d EB |
217 | |
218 | if (ctx.format != FS_ENCRYPTION_CONTEXT_FORMAT_V1) | |
219 | return -EINVAL; | |
220 | ||
221 | if (ctx.flags & ~FS_POLICY_FLAGS_VALID) | |
222 | return -EINVAL; | |
0adda907 | 223 | |
0b81d077 | 224 | crypt_info = kmem_cache_alloc(fscrypt_info_cachep, GFP_NOFS); |
0adda907 JK |
225 | if (!crypt_info) |
226 | return -ENOMEM; | |
227 | ||
228 | crypt_info->ci_flags = ctx.flags; | |
229 | crypt_info->ci_data_mode = ctx.contents_encryption_mode; | |
230 | crypt_info->ci_filename_mode = ctx.filenames_encryption_mode; | |
231 | crypt_info->ci_ctfm = NULL; | |
26bf3dc7 | 232 | crypt_info->ci_keyring_key = NULL; |
0adda907 JK |
233 | memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor, |
234 | sizeof(crypt_info->ci_master_key)); | |
640778fb | 235 | |
8f39850d EB |
236 | res = determine_cipher_type(crypt_info, inode, &cipher_str, &keysize); |
237 | if (res) | |
26bf3dc7 | 238 | goto out; |
8f39850d | 239 | |
a6e08912 EB |
240 | /* |
241 | * This cannot be a stack buffer because it is passed to the scatterlist | |
242 | * crypto API as part of key derivation. | |
243 | */ | |
244 | res = -ENOMEM; | |
245 | raw_key = kmalloc(FS_MAX_KEY_SIZE, GFP_NOFS); | |
246 | if (!raw_key) | |
247 | goto out; | |
248 | ||
a5d431ef | 249 | res = validate_user_key(crypt_info, &ctx, raw_key, FS_KEY_DESC_PREFIX); |
b5a7aef1 | 250 | if (res && inode->i_sb->s_cop->key_prefix) { |
a5d431ef EB |
251 | int res2 = validate_user_key(crypt_info, &ctx, raw_key, |
252 | inode->i_sb->s_cop->key_prefix); | |
b5a7aef1 JK |
253 | if (res2) { |
254 | if (res2 == -ENOKEY) | |
255 | res = -ENOKEY; | |
256 | goto out; | |
257 | } | |
258 | } else if (res) { | |
66aa3e12 JK |
259 | goto out; |
260 | } | |
d407574e | 261 | ctfm = crypto_alloc_skcipher(cipher_str, 0, 0); |
26bf3dc7 JK |
262 | if (!ctfm || IS_ERR(ctfm)) { |
263 | res = ctfm ? PTR_ERR(ctfm) : -ENOMEM; | |
264 | printk(KERN_DEBUG | |
265 | "%s: error %d (inode %u) allocating crypto tfm\n", | |
266 | __func__, res, (unsigned) inode->i_ino); | |
267 | goto out; | |
0adda907 | 268 | } |
26bf3dc7 | 269 | crypt_info->ci_ctfm = ctfm; |
d407574e LT |
270 | crypto_skcipher_clear_flags(ctfm, ~0); |
271 | crypto_skcipher_set_flags(ctfm, CRYPTO_TFM_REQ_WEAK_KEY); | |
8f39850d | 272 | res = crypto_skcipher_setkey(ctfm, raw_key, keysize); |
26bf3dc7 JK |
273 | if (res) |
274 | goto out; | |
275 | ||
a6e08912 EB |
276 | kzfree(raw_key); |
277 | raw_key = NULL; | |
0b81d077 JK |
278 | if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) != NULL) { |
279 | put_crypt_info(crypt_info); | |
26bf3dc7 JK |
280 | goto retry; |
281 | } | |
282 | return 0; | |
283 | ||
284 | out: | |
0b81d077 | 285 | if (res == -ENOKEY) |
26bf3dc7 | 286 | res = 0; |
0b81d077 | 287 | put_crypt_info(crypt_info); |
a6e08912 | 288 | kzfree(raw_key); |
0adda907 JK |
289 | return res; |
290 | } | |
291 | ||
0b81d077 | 292 | void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci) |
0adda907 | 293 | { |
0b81d077 JK |
294 | struct fscrypt_info *prev; |
295 | ||
296 | if (ci == NULL) | |
297 | ci = ACCESS_ONCE(inode->i_crypt_info); | |
298 | if (ci == NULL) | |
299 | return; | |
0adda907 | 300 | |
0b81d077 JK |
301 | prev = cmpxchg(&inode->i_crypt_info, ci, NULL); |
302 | if (prev != ci) | |
303 | return; | |
304 | ||
305 | put_crypt_info(ci); | |
306 | } | |
307 | EXPORT_SYMBOL(fscrypt_put_encryption_info); | |
308 | ||
309 | int fscrypt_get_encryption_info(struct inode *inode) | |
310 | { | |
311 | struct fscrypt_info *ci = inode->i_crypt_info; | |
312 | ||
313 | if (!ci || | |
314 | (ci->ci_keyring_key && | |
315 | (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) | | |
316 | (1 << KEY_FLAG_REVOKED) | | |
317 | (1 << KEY_FLAG_DEAD))))) | |
3325bea5 | 318 | return fscrypt_get_crypt_info(inode); |
0b81d077 | 319 | return 0; |
0adda907 | 320 | } |
0b81d077 | 321 | EXPORT_SYMBOL(fscrypt_get_encryption_info); |