Greg Kroah-Hartman | b244131 | 2017-11-01 15:07:57 +0100 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0 |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 2 | /* |
| 3 | * key management facility for FS encryption support. |
| 4 | * |
| 5 | * Copyright (C) 2015, Google, Inc. |
| 6 | * |
| 7 | * This contains encryption key functions. |
| 8 | * |
| 9 | * Written by Michael Halcrow, Ildar Muslukhov, and Uday Savagaonkar, 2015. |
| 10 | */ |
| 11 | |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 12 | #include <keys/user-type.h> |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 13 | #include <linux/hashtable.h> |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 14 | #include <linux/scatterlist.h> |
Daniel Walter | b7e7cf7 | 2017-06-19 09:27:58 +0200 | [diff] [blame] | 15 | #include <linux/ratelimit.h> |
| 16 | #include <crypto/aes.h> |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 17 | #include <crypto/algapi.h> |
Daniel Walter | b7e7cf7 | 2017-06-19 09:27:58 +0200 | [diff] [blame] | 18 | #include <crypto/sha.h> |
Eric Biggers | a575784 | 2018-01-05 10:45:00 -0800 | [diff] [blame] | 19 | #include <crypto/skcipher.h> |
Theodore Ts'o | 3325bea | 2016-11-26 20:32:46 -0500 | [diff] [blame] | 20 | #include "fscrypt_private.h" |
Zhen Kong | ee7bdc6 | 2019-03-14 10:55:19 -0700 | [diff] [blame^] | 21 | #include "fscrypt_ice.h" |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 22 | |
Daniel Walter | b7e7cf7 | 2017-06-19 09:27:58 +0200 | [diff] [blame] | 23 | static struct crypto_shash *essiv_hash_tfm; |
| 24 | |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 25 | /* Table of keys referenced by FS_POLICY_FLAG_DIRECT_KEY policies */ |
| 26 | static DEFINE_HASHTABLE(fscrypt_master_keys, 6); /* 6 bits = 64 buckets */ |
| 27 | static DEFINE_SPINLOCK(fscrypt_master_keys_lock); |
| 28 | |
Eric Biggers | 646b7d4 | 2018-04-30 15:51:49 -0700 | [diff] [blame] | 29 | /* |
| 30 | * Key derivation function. This generates the derived key by encrypting the |
| 31 | * master key with AES-128-ECB using the inode's nonce as the AES key. |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 32 | * |
Eric Biggers | 646b7d4 | 2018-04-30 15:51:49 -0700 | [diff] [blame] | 33 | * The master key must be at least as long as the derived key. If the master |
| 34 | * key is longer, then only the first 'derived_keysize' bytes are used. |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 35 | */ |
Eric Biggers | 646b7d4 | 2018-04-30 15:51:49 -0700 | [diff] [blame] | 36 | static int derive_key_aes(const u8 *master_key, |
| 37 | const struct fscrypt_context *ctx, |
| 38 | u8 *derived_key, unsigned int derived_keysize) |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 39 | { |
| 40 | int res = 0; |
Linus Torvalds | d407574 | 2016-03-21 11:03:02 -0700 | [diff] [blame] | 41 | struct skcipher_request *req = NULL; |
Gilad Ben-Yossef | d0082e1 | 2017-10-18 08:00:44 +0100 | [diff] [blame] | 42 | DECLARE_CRYPTO_WAIT(wait); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 43 | struct scatterlist src_sg, dst_sg; |
Linus Torvalds | d407574 | 2016-03-21 11:03:02 -0700 | [diff] [blame] | 44 | struct crypto_skcipher *tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 45 | |
| 46 | if (IS_ERR(tfm)) { |
| 47 | res = PTR_ERR(tfm); |
| 48 | tfm = NULL; |
| 49 | goto out; |
| 50 | } |
Linus Torvalds | d407574 | 2016-03-21 11:03:02 -0700 | [diff] [blame] | 51 | crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_WEAK_KEY); |
| 52 | req = skcipher_request_alloc(tfm, GFP_NOFS); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 53 | if (!req) { |
| 54 | res = -ENOMEM; |
| 55 | goto out; |
| 56 | } |
Linus Torvalds | d407574 | 2016-03-21 11:03:02 -0700 | [diff] [blame] | 57 | skcipher_request_set_callback(req, |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 58 | CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, |
Gilad Ben-Yossef | d0082e1 | 2017-10-18 08:00:44 +0100 | [diff] [blame] | 59 | crypto_req_done, &wait); |
Eric Biggers | 646b7d4 | 2018-04-30 15:51:49 -0700 | [diff] [blame] | 60 | res = crypto_skcipher_setkey(tfm, ctx->nonce, sizeof(ctx->nonce)); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 61 | if (res < 0) |
| 62 | goto out; |
| 63 | |
Eric Biggers | 646b7d4 | 2018-04-30 15:51:49 -0700 | [diff] [blame] | 64 | sg_init_one(&src_sg, master_key, derived_keysize); |
| 65 | sg_init_one(&dst_sg, derived_key, derived_keysize); |
| 66 | skcipher_request_set_crypt(req, &src_sg, &dst_sg, derived_keysize, |
Daniel Walter | b7e7cf7 | 2017-06-19 09:27:58 +0200 | [diff] [blame] | 67 | NULL); |
Gilad Ben-Yossef | d0082e1 | 2017-10-18 08:00:44 +0100 | [diff] [blame] | 68 | res = crypto_wait_req(crypto_skcipher_encrypt(req), &wait); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 69 | out: |
Linus Torvalds | d407574 | 2016-03-21 11:03:02 -0700 | [diff] [blame] | 70 | skcipher_request_free(req); |
| 71 | crypto_free_skcipher(tfm); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 72 | return res; |
| 73 | } |
| 74 | |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 75 | /* |
| 76 | * Search the current task's subscribed keyrings for a "logon" key with |
| 77 | * description prefix:descriptor, and if found acquire a read lock on it and |
| 78 | * return a pointer to its validated payload in *payload_ret. |
| 79 | */ |
| 80 | static struct key * |
| 81 | find_and_lock_process_key(const char *prefix, |
| 82 | const u8 descriptor[FS_KEY_DESCRIPTOR_SIZE], |
| 83 | unsigned int min_keysize, |
| 84 | const struct fscrypt_key **payload_ret) |
Jaegeuk Kim | b5a7aef | 2016-05-04 22:05:01 -0700 | [diff] [blame] | 85 | { |
Eric Biggers | a5d431e | 2017-01-05 13:51:18 -0800 | [diff] [blame] | 86 | char *description; |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 87 | struct key *key; |
Jaegeuk Kim | b5a7aef | 2016-05-04 22:05:01 -0700 | [diff] [blame] | 88 | const struct user_key_payload *ukp; |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 89 | const struct fscrypt_key *payload; |
Jaegeuk Kim | b5a7aef | 2016-05-04 22:05:01 -0700 | [diff] [blame] | 90 | |
Eric Biggers | a5d431e | 2017-01-05 13:51:18 -0800 | [diff] [blame] | 91 | description = kasprintf(GFP_NOFS, "%s%*phN", prefix, |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 92 | FS_KEY_DESCRIPTOR_SIZE, descriptor); |
Eric Biggers | a5d431e | 2017-01-05 13:51:18 -0800 | [diff] [blame] | 93 | if (!description) |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 94 | return ERR_PTR(-ENOMEM); |
Jaegeuk Kim | b5a7aef | 2016-05-04 22:05:01 -0700 | [diff] [blame] | 95 | |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 96 | key = request_key(&key_type_logon, description, NULL); |
Eric Biggers | a5d431e | 2017-01-05 13:51:18 -0800 | [diff] [blame] | 97 | kfree(description); |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 98 | if (IS_ERR(key)) |
| 99 | return key; |
Jaegeuk Kim | b5a7aef | 2016-05-04 22:05:01 -0700 | [diff] [blame] | 100 | |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 101 | down_read(&key->sem); |
| 102 | ukp = user_key_payload_locked(key); |
Jaegeuk Kim | b5a7aef | 2016-05-04 22:05:01 -0700 | [diff] [blame] | 103 | |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 104 | if (!ukp) /* was the key revoked before we acquired its semaphore? */ |
| 105 | goto invalid; |
| 106 | |
| 107 | payload = (const struct fscrypt_key *)ukp->data; |
| 108 | |
| 109 | if (ukp->datalen != sizeof(struct fscrypt_key) || |
| 110 | payload->size < 1 || payload->size > FS_MAX_KEY_SIZE) { |
| 111 | fscrypt_warn(NULL, |
| 112 | "key with description '%s' has invalid payload", |
| 113 | key->description); |
| 114 | goto invalid; |
Jaegeuk Kim | b5a7aef | 2016-05-04 22:05:01 -0700 | [diff] [blame] | 115 | } |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 116 | |
Eric Biggers | 646b7d4 | 2018-04-30 15:51:49 -0700 | [diff] [blame] | 117 | if (payload->size < min_keysize) { |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 118 | fscrypt_warn(NULL, |
Eric Biggers | 646b7d4 | 2018-04-30 15:51:49 -0700 | [diff] [blame] | 119 | "key with description '%s' is too short (got %u bytes, need %u+ bytes)", |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 120 | key->description, payload->size, min_keysize); |
| 121 | goto invalid; |
| 122 | } |
| 123 | |
| 124 | *payload_ret = payload; |
| 125 | return key; |
| 126 | |
| 127 | invalid: |
| 128 | up_read(&key->sem); |
| 129 | key_put(key); |
| 130 | return ERR_PTR(-ENOKEY); |
| 131 | } |
| 132 | |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 133 | static struct fscrypt_mode available_modes[] = { |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 134 | [FS_ENCRYPTION_MODE_AES_256_XTS] = { |
| 135 | .friendly_name = "AES-256-XTS", |
| 136 | .cipher_str = "xts(aes)", |
| 137 | .keysize = 64, |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 138 | .ivsize = 16, |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 139 | }, |
| 140 | [FS_ENCRYPTION_MODE_AES_256_CTS] = { |
| 141 | .friendly_name = "AES-256-CTS-CBC", |
| 142 | .cipher_str = "cts(cbc(aes))", |
| 143 | .keysize = 32, |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 144 | .ivsize = 16, |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 145 | }, |
| 146 | [FS_ENCRYPTION_MODE_AES_128_CBC] = { |
| 147 | .friendly_name = "AES-128-CBC", |
| 148 | .cipher_str = "cbc(aes)", |
| 149 | .keysize = 16, |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 150 | .ivsize = 16, |
| 151 | .needs_essiv = true, |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 152 | }, |
| 153 | [FS_ENCRYPTION_MODE_AES_128_CTS] = { |
| 154 | .friendly_name = "AES-128-CTS-CBC", |
| 155 | .cipher_str = "cts(cbc(aes))", |
| 156 | .keysize = 16, |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 157 | .ivsize = 16, |
| 158 | }, |
| 159 | [FS_ENCRYPTION_MODE_ADIANTUM] = { |
| 160 | .friendly_name = "Adiantum", |
| 161 | .cipher_str = "adiantum(xchacha12,aes)", |
| 162 | .keysize = 32, |
| 163 | .ivsize = 32, |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 164 | }, |
Zhen Kong | ee7bdc6 | 2019-03-14 10:55:19 -0700 | [diff] [blame^] | 165 | [FS_ENCRYPTION_MODE_PRIVATE] = { |
| 166 | .friendly_name = "ice", |
| 167 | .cipher_str = "xts(aes)", |
| 168 | .keysize = 64, |
| 169 | .ivsize = 16, |
| 170 | .inline_encryption = true, |
| 171 | }, |
Daniel Walter | b7e7cf7 | 2017-06-19 09:27:58 +0200 | [diff] [blame] | 172 | }; |
| 173 | |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 174 | static struct fscrypt_mode * |
| 175 | select_encryption_mode(const struct fscrypt_info *ci, const struct inode *inode) |
Eric Biggers | 8f39850 | 2016-09-15 13:32:11 -0400 | [diff] [blame] | 176 | { |
Zhen Kong | ee7bdc6 | 2019-03-14 10:55:19 -0700 | [diff] [blame^] | 177 | struct fscrypt_mode *mode = NULL; |
| 178 | |
Daniel Walter | b7e7cf7 | 2017-06-19 09:27:58 +0200 | [diff] [blame] | 179 | if (!fscrypt_valid_enc_modes(ci->ci_data_mode, ci->ci_filename_mode)) { |
Eric Biggers | 544d08f | 2018-04-30 15:51:47 -0700 | [diff] [blame] | 180 | fscrypt_warn(inode->i_sb, |
| 181 | "inode %lu uses unsupported encryption modes (contents mode %d, filenames mode %d)", |
| 182 | inode->i_ino, ci->ci_data_mode, |
| 183 | ci->ci_filename_mode); |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 184 | return ERR_PTR(-EINVAL); |
Daniel Walter | b7e7cf7 | 2017-06-19 09:27:58 +0200 | [diff] [blame] | 185 | } |
| 186 | |
Zhen Kong | ee7bdc6 | 2019-03-14 10:55:19 -0700 | [diff] [blame^] | 187 | if (S_ISREG(inode->i_mode)) { |
| 188 | mode = &available_modes[ci->ci_data_mode]; |
| 189 | if (IS_ERR(mode)) { |
| 190 | fscrypt_warn(inode->i_sb, "Invalid mode"); |
| 191 | return ERR_PTR(-EINVAL); |
| 192 | } |
| 193 | if (mode->inline_encryption && |
| 194 | !fscrypt_is_ice_capable(inode->i_sb)) { |
| 195 | fscrypt_warn(inode->i_sb, "ICE support not available"); |
| 196 | return ERR_PTR(-EINVAL); |
| 197 | } |
| 198 | return mode; |
| 199 | } |
Eric Biggers | 8f39850 | 2016-09-15 13:32:11 -0400 | [diff] [blame] | 200 | |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 201 | if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) |
| 202 | return &available_modes[ci->ci_filename_mode]; |
| 203 | |
| 204 | WARN_ONCE(1, "fscrypt: filesystem tried to load encryption info for inode %lu, which is not encryptable (file type %d)\n", |
| 205 | inode->i_ino, (inode->i_mode & S_IFMT)); |
| 206 | return ERR_PTR(-EINVAL); |
Eric Biggers | 8f39850 | 2016-09-15 13:32:11 -0400 | [diff] [blame] | 207 | } |
| 208 | |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 209 | /* Find the master key, then derive the inode's actual encryption key */ |
| 210 | static int find_and_derive_key(const struct inode *inode, |
| 211 | const struct fscrypt_context *ctx, |
| 212 | u8 *derived_key, const struct fscrypt_mode *mode) |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 213 | { |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 214 | struct key *key; |
| 215 | const struct fscrypt_key *payload; |
| 216 | int err; |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 217 | |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 218 | key = find_and_lock_process_key(FS_KEY_DESC_PREFIX, |
| 219 | ctx->master_key_descriptor, |
| 220 | mode->keysize, &payload); |
| 221 | if (key == ERR_PTR(-ENOKEY) && inode->i_sb->s_cop->key_prefix) { |
| 222 | key = find_and_lock_process_key(inode->i_sb->s_cop->key_prefix, |
| 223 | ctx->master_key_descriptor, |
| 224 | mode->keysize, &payload); |
| 225 | } |
| 226 | if (IS_ERR(key)) |
| 227 | return PTR_ERR(key); |
| 228 | |
| 229 | if (ctx->flags & FS_POLICY_FLAG_DIRECT_KEY) { |
| 230 | if (mode->ivsize < offsetofend(union fscrypt_iv, nonce)) { |
| 231 | fscrypt_warn(inode->i_sb, |
| 232 | "direct key mode not allowed with %s", |
| 233 | mode->friendly_name); |
| 234 | err = -EINVAL; |
| 235 | } else if (ctx->contents_encryption_mode != |
| 236 | ctx->filenames_encryption_mode) { |
| 237 | fscrypt_warn(inode->i_sb, |
| 238 | "direct key mode not allowed with different contents and filenames modes"); |
| 239 | err = -EINVAL; |
| 240 | } else { |
| 241 | memcpy(derived_key, payload->raw, mode->keysize); |
| 242 | err = 0; |
| 243 | } |
Zhen Kong | ee7bdc6 | 2019-03-14 10:55:19 -0700 | [diff] [blame^] | 244 | } else if (mode->inline_encryption) { |
| 245 | memcpy(derived_key, payload->raw, mode->keysize); |
| 246 | err = 0; |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 247 | } else { |
| 248 | err = derive_key_aes(payload->raw, ctx, derived_key, |
| 249 | mode->keysize); |
| 250 | } |
| 251 | up_read(&key->sem); |
| 252 | key_put(key); |
| 253 | return err; |
| 254 | } |
| 255 | |
| 256 | /* Allocate and key a symmetric cipher object for the given encryption mode */ |
| 257 | static struct crypto_skcipher * |
| 258 | allocate_skcipher_for_mode(struct fscrypt_mode *mode, const u8 *raw_key, |
| 259 | const struct inode *inode) |
| 260 | { |
| 261 | struct crypto_skcipher *tfm; |
| 262 | int err; |
| 263 | |
| 264 | tfm = crypto_alloc_skcipher(mode->cipher_str, 0, 0); |
| 265 | if (IS_ERR(tfm)) { |
| 266 | fscrypt_warn(inode->i_sb, |
| 267 | "error allocating '%s' transform for inode %lu: %ld", |
| 268 | mode->cipher_str, inode->i_ino, PTR_ERR(tfm)); |
| 269 | return tfm; |
| 270 | } |
| 271 | if (unlikely(!mode->logged_impl_name)) { |
| 272 | /* |
| 273 | * fscrypt performance can vary greatly depending on which |
| 274 | * crypto algorithm implementation is used. Help people debug |
| 275 | * performance problems by logging the ->cra_driver_name the |
| 276 | * first time a mode is used. Note that multiple threads can |
| 277 | * race here, but it doesn't really matter. |
| 278 | */ |
| 279 | mode->logged_impl_name = true; |
| 280 | pr_info("fscrypt: %s using implementation \"%s\"\n", |
| 281 | mode->friendly_name, |
| 282 | crypto_skcipher_alg(tfm)->base.cra_driver_name); |
| 283 | } |
| 284 | crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_WEAK_KEY); |
| 285 | err = crypto_skcipher_setkey(tfm, raw_key, mode->keysize); |
| 286 | if (err) |
| 287 | goto err_free_tfm; |
| 288 | |
| 289 | return tfm; |
| 290 | |
| 291 | err_free_tfm: |
| 292 | crypto_free_skcipher(tfm); |
| 293 | return ERR_PTR(err); |
| 294 | } |
| 295 | |
| 296 | /* Master key referenced by FS_POLICY_FLAG_DIRECT_KEY policy */ |
| 297 | struct fscrypt_master_key { |
| 298 | struct hlist_node mk_node; |
| 299 | refcount_t mk_refcount; |
| 300 | const struct fscrypt_mode *mk_mode; |
| 301 | struct crypto_skcipher *mk_ctfm; |
| 302 | u8 mk_descriptor[FS_KEY_DESCRIPTOR_SIZE]; |
| 303 | u8 mk_raw[FS_MAX_KEY_SIZE]; |
| 304 | }; |
| 305 | |
| 306 | static void free_master_key(struct fscrypt_master_key *mk) |
| 307 | { |
| 308 | if (mk) { |
| 309 | crypto_free_skcipher(mk->mk_ctfm); |
| 310 | kzfree(mk); |
| 311 | } |
| 312 | } |
| 313 | |
| 314 | static void put_master_key(struct fscrypt_master_key *mk) |
| 315 | { |
| 316 | if (!refcount_dec_and_lock(&mk->mk_refcount, &fscrypt_master_keys_lock)) |
| 317 | return; |
| 318 | hash_del(&mk->mk_node); |
| 319 | spin_unlock(&fscrypt_master_keys_lock); |
| 320 | |
| 321 | free_master_key(mk); |
| 322 | } |
| 323 | |
| 324 | /* |
| 325 | * Find/insert the given master key into the fscrypt_master_keys table. If |
| 326 | * found, it is returned with elevated refcount, and 'to_insert' is freed if |
| 327 | * non-NULL. If not found, 'to_insert' is inserted and returned if it's |
| 328 | * non-NULL; otherwise NULL is returned. |
| 329 | */ |
| 330 | static struct fscrypt_master_key * |
| 331 | find_or_insert_master_key(struct fscrypt_master_key *to_insert, |
| 332 | const u8 *raw_key, const struct fscrypt_mode *mode, |
| 333 | const struct fscrypt_info *ci) |
| 334 | { |
| 335 | unsigned long hash_key; |
| 336 | struct fscrypt_master_key *mk; |
| 337 | |
| 338 | /* |
| 339 | * Careful: to avoid potentially leaking secret key bytes via timing |
| 340 | * information, we must key the hash table by descriptor rather than by |
| 341 | * raw key, and use crypto_memneq() when comparing raw keys. |
| 342 | */ |
| 343 | |
| 344 | BUILD_BUG_ON(sizeof(hash_key) > FS_KEY_DESCRIPTOR_SIZE); |
| 345 | memcpy(&hash_key, ci->ci_master_key_descriptor, sizeof(hash_key)); |
| 346 | |
| 347 | spin_lock(&fscrypt_master_keys_lock); |
| 348 | hash_for_each_possible(fscrypt_master_keys, mk, mk_node, hash_key) { |
| 349 | if (memcmp(ci->ci_master_key_descriptor, mk->mk_descriptor, |
| 350 | FS_KEY_DESCRIPTOR_SIZE) != 0) |
| 351 | continue; |
| 352 | if (mode != mk->mk_mode) |
| 353 | continue; |
| 354 | if (crypto_memneq(raw_key, mk->mk_raw, mode->keysize)) |
| 355 | continue; |
| 356 | /* using existing tfm with same (descriptor, mode, raw_key) */ |
| 357 | refcount_inc(&mk->mk_refcount); |
| 358 | spin_unlock(&fscrypt_master_keys_lock); |
| 359 | free_master_key(to_insert); |
| 360 | return mk; |
| 361 | } |
| 362 | if (to_insert) |
| 363 | hash_add(fscrypt_master_keys, &to_insert->mk_node, hash_key); |
| 364 | spin_unlock(&fscrypt_master_keys_lock); |
| 365 | return to_insert; |
| 366 | } |
| 367 | |
| 368 | /* Prepare to encrypt directly using the master key in the given mode */ |
| 369 | static struct fscrypt_master_key * |
| 370 | fscrypt_get_master_key(const struct fscrypt_info *ci, struct fscrypt_mode *mode, |
| 371 | const u8 *raw_key, const struct inode *inode) |
| 372 | { |
| 373 | struct fscrypt_master_key *mk; |
| 374 | int err; |
| 375 | |
| 376 | /* Is there already a tfm for this key? */ |
| 377 | mk = find_or_insert_master_key(NULL, raw_key, mode, ci); |
| 378 | if (mk) |
| 379 | return mk; |
| 380 | |
| 381 | /* Nope, allocate one. */ |
| 382 | mk = kzalloc(sizeof(*mk), GFP_NOFS); |
| 383 | if (!mk) |
| 384 | return ERR_PTR(-ENOMEM); |
| 385 | refcount_set(&mk->mk_refcount, 1); |
| 386 | mk->mk_mode = mode; |
| 387 | mk->mk_ctfm = allocate_skcipher_for_mode(mode, raw_key, inode); |
| 388 | if (IS_ERR(mk->mk_ctfm)) { |
| 389 | err = PTR_ERR(mk->mk_ctfm); |
| 390 | mk->mk_ctfm = NULL; |
| 391 | goto err_free_mk; |
| 392 | } |
| 393 | memcpy(mk->mk_descriptor, ci->ci_master_key_descriptor, |
| 394 | FS_KEY_DESCRIPTOR_SIZE); |
| 395 | memcpy(mk->mk_raw, raw_key, mode->keysize); |
| 396 | |
| 397 | return find_or_insert_master_key(mk, raw_key, mode, ci); |
| 398 | |
| 399 | err_free_mk: |
| 400 | free_master_key(mk); |
| 401 | return ERR_PTR(err); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 402 | } |
| 403 | |
Daniel Walter | b7e7cf7 | 2017-06-19 09:27:58 +0200 | [diff] [blame] | 404 | static int derive_essiv_salt(const u8 *key, int keysize, u8 *salt) |
| 405 | { |
| 406 | struct crypto_shash *tfm = READ_ONCE(essiv_hash_tfm); |
| 407 | |
| 408 | /* init hash transform on demand */ |
| 409 | if (unlikely(!tfm)) { |
| 410 | struct crypto_shash *prev_tfm; |
| 411 | |
| 412 | tfm = crypto_alloc_shash("sha256", 0, 0); |
| 413 | if (IS_ERR(tfm)) { |
Eric Biggers | 544d08f | 2018-04-30 15:51:47 -0700 | [diff] [blame] | 414 | fscrypt_warn(NULL, |
| 415 | "error allocating SHA-256 transform: %ld", |
| 416 | PTR_ERR(tfm)); |
Daniel Walter | b7e7cf7 | 2017-06-19 09:27:58 +0200 | [diff] [blame] | 417 | return PTR_ERR(tfm); |
| 418 | } |
| 419 | prev_tfm = cmpxchg(&essiv_hash_tfm, NULL, tfm); |
| 420 | if (prev_tfm) { |
| 421 | crypto_free_shash(tfm); |
| 422 | tfm = prev_tfm; |
| 423 | } |
| 424 | } |
| 425 | |
| 426 | { |
| 427 | SHASH_DESC_ON_STACK(desc, tfm); |
| 428 | desc->tfm = tfm; |
| 429 | desc->flags = 0; |
| 430 | |
| 431 | return crypto_shash_digest(desc, key, keysize, salt); |
| 432 | } |
| 433 | } |
| 434 | |
| 435 | static int init_essiv_generator(struct fscrypt_info *ci, const u8 *raw_key, |
| 436 | int keysize) |
| 437 | { |
| 438 | int err; |
| 439 | struct crypto_cipher *essiv_tfm; |
| 440 | u8 salt[SHA256_DIGEST_SIZE]; |
| 441 | |
| 442 | essiv_tfm = crypto_alloc_cipher("aes", 0, 0); |
| 443 | if (IS_ERR(essiv_tfm)) |
| 444 | return PTR_ERR(essiv_tfm); |
| 445 | |
| 446 | ci->ci_essiv_tfm = essiv_tfm; |
| 447 | |
| 448 | err = derive_essiv_salt(raw_key, keysize, salt); |
| 449 | if (err) |
| 450 | goto out; |
| 451 | |
| 452 | /* |
| 453 | * Using SHA256 to derive the salt/key will result in AES-256 being |
| 454 | * used for IV generation. File contents encryption will still use the |
| 455 | * configured keysize (AES-128) nevertheless. |
| 456 | */ |
| 457 | err = crypto_cipher_setkey(essiv_tfm, salt, sizeof(salt)); |
| 458 | if (err) |
| 459 | goto out; |
| 460 | |
| 461 | out: |
| 462 | memzero_explicit(salt, sizeof(salt)); |
| 463 | return err; |
| 464 | } |
| 465 | |
| 466 | void __exit fscrypt_essiv_cleanup(void) |
| 467 | { |
| 468 | crypto_free_shash(essiv_hash_tfm); |
| 469 | } |
| 470 | |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 471 | /* |
| 472 | * Given the encryption mode and key (normally the derived key, but for |
| 473 | * FS_POLICY_FLAG_DIRECT_KEY mode it's the master key), set up the inode's |
| 474 | * symmetric cipher transform object(s). |
| 475 | */ |
| 476 | static int setup_crypto_transform(struct fscrypt_info *ci, |
| 477 | struct fscrypt_mode *mode, |
| 478 | const u8 *raw_key, const struct inode *inode) |
| 479 | { |
| 480 | struct fscrypt_master_key *mk; |
| 481 | struct crypto_skcipher *ctfm; |
| 482 | int err; |
| 483 | |
| 484 | if (ci->ci_flags & FS_POLICY_FLAG_DIRECT_KEY) { |
| 485 | mk = fscrypt_get_master_key(ci, mode, raw_key, inode); |
| 486 | if (IS_ERR(mk)) |
| 487 | return PTR_ERR(mk); |
| 488 | ctfm = mk->mk_ctfm; |
| 489 | } else { |
| 490 | mk = NULL; |
| 491 | ctfm = allocate_skcipher_for_mode(mode, raw_key, inode); |
| 492 | if (IS_ERR(ctfm)) |
| 493 | return PTR_ERR(ctfm); |
| 494 | } |
| 495 | ci->ci_master_key = mk; |
| 496 | ci->ci_ctfm = ctfm; |
| 497 | |
| 498 | if (mode->needs_essiv) { |
| 499 | /* ESSIV implies 16-byte IVs which implies !DIRECT_KEY */ |
| 500 | WARN_ON(mode->ivsize != AES_BLOCK_SIZE); |
| 501 | WARN_ON(ci->ci_flags & FS_POLICY_FLAG_DIRECT_KEY); |
| 502 | |
| 503 | err = init_essiv_generator(ci, raw_key, mode->keysize); |
| 504 | if (err) { |
| 505 | fscrypt_warn(inode->i_sb, |
| 506 | "error initializing ESSIV generator for inode %lu: %d", |
| 507 | inode->i_ino, err); |
| 508 | return err; |
| 509 | } |
| 510 | } |
| 511 | return 0; |
| 512 | } |
| 513 | |
| 514 | static void put_crypt_info(struct fscrypt_info *ci) |
| 515 | { |
| 516 | if (!ci) |
| 517 | return; |
| 518 | |
| 519 | if (ci->ci_master_key) { |
| 520 | put_master_key(ci->ci_master_key); |
| 521 | } else { |
Zhen Kong | ee7bdc6 | 2019-03-14 10:55:19 -0700 | [diff] [blame^] | 522 | if (ci->ci_ctfm) |
| 523 | crypto_free_skcipher(ci->ci_ctfm); |
| 524 | if (ci->ci_essiv_tfm) |
| 525 | crypto_free_cipher(ci->ci_essiv_tfm); |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 526 | } |
Zhen Kong | ee7bdc6 | 2019-03-14 10:55:19 -0700 | [diff] [blame^] | 527 | memset(ci->ci_raw_key, 0, sizeof(ci->ci_raw_key)); |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 528 | kmem_cache_free(fscrypt_info_cachep, ci); |
| 529 | } |
| 530 | |
Zhen Kong | ee7bdc6 | 2019-03-14 10:55:19 -0700 | [diff] [blame^] | 531 | static int fscrypt_data_encryption_mode(struct inode *inode) |
| 532 | { |
| 533 | return fscrypt_should_be_processed_by_ice(inode) ? |
| 534 | FS_ENCRYPTION_MODE_PRIVATE : FS_ENCRYPTION_MODE_AES_256_XTS; |
| 535 | } |
| 536 | |
Eric Biggers | 1b53cf9 | 2017-02-21 15:07:11 -0800 | [diff] [blame] | 537 | int fscrypt_get_encryption_info(struct inode *inode) |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 538 | { |
| 539 | struct fscrypt_info *crypt_info; |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 540 | struct fscrypt_context ctx; |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 541 | struct fscrypt_mode *mode; |
Eric Biggers | a6e0891 | 2016-11-13 20:41:09 -0500 | [diff] [blame] | 542 | u8 *raw_key = NULL; |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 543 | int res; |
| 544 | |
Eric Biggers | 1b53cf9 | 2017-02-21 15:07:11 -0800 | [diff] [blame] | 545 | if (inode->i_crypt_info) |
| 546 | return 0; |
| 547 | |
David Gstir | f32d7ac | 2016-12-06 23:53:57 +0100 | [diff] [blame] | 548 | res = fscrypt_initialize(inode->i_sb->s_cop->flags); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 549 | if (res) |
| 550 | return res; |
| 551 | |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 552 | res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); |
| 553 | if (res < 0) { |
Theodore Ts'o | 5bbdcbb | 2017-01-02 15:12:17 -0500 | [diff] [blame] | 554 | if (!fscrypt_dummy_context_enabled(inode) || |
Eric Biggers | e0428a2 | 2017-10-09 12:15:36 -0700 | [diff] [blame] | 555 | IS_ENCRYPTED(inode)) |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 556 | return res; |
Theodore Ts'o | 5bbdcbb | 2017-01-02 15:12:17 -0500 | [diff] [blame] | 557 | /* Fake up a context for an unencrypted directory */ |
| 558 | memset(&ctx, 0, sizeof(ctx)); |
Eric Biggers | 8f39850 | 2016-09-15 13:32:11 -0400 | [diff] [blame] | 559 | ctx.format = FS_ENCRYPTION_CONTEXT_FORMAT_V1; |
Zhen Kong | ee7bdc6 | 2019-03-14 10:55:19 -0700 | [diff] [blame^] | 560 | ctx.contents_encryption_mode = |
| 561 | fscrypt_data_encryption_mode(inode); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 562 | ctx.filenames_encryption_mode = FS_ENCRYPTION_MODE_AES_256_CTS; |
Theodore Ts'o | 5bbdcbb | 2017-01-02 15:12:17 -0500 | [diff] [blame] | 563 | memset(ctx.master_key_descriptor, 0x42, FS_KEY_DESCRIPTOR_SIZE); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 564 | } else if (res != sizeof(ctx)) { |
| 565 | return -EINVAL; |
| 566 | } |
Eric Biggers | 8f39850 | 2016-09-15 13:32:11 -0400 | [diff] [blame] | 567 | |
| 568 | if (ctx.format != FS_ENCRYPTION_CONTEXT_FORMAT_V1) |
| 569 | return -EINVAL; |
| 570 | |
| 571 | if (ctx.flags & ~FS_POLICY_FLAGS_VALID) |
| 572 | return -EINVAL; |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 573 | |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 574 | crypt_info = kmem_cache_zalloc(fscrypt_info_cachep, GFP_NOFS); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 575 | if (!crypt_info) |
| 576 | return -ENOMEM; |
| 577 | |
| 578 | crypt_info->ci_flags = ctx.flags; |
| 579 | crypt_info->ci_data_mode = ctx.contents_encryption_mode; |
| 580 | crypt_info->ci_filename_mode = ctx.filenames_encryption_mode; |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 581 | memcpy(crypt_info->ci_master_key_descriptor, ctx.master_key_descriptor, |
| 582 | FS_KEY_DESCRIPTOR_SIZE); |
| 583 | memcpy(crypt_info->ci_nonce, ctx.nonce, FS_KEY_DERIVATION_NONCE_SIZE); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 584 | |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 585 | mode = select_encryption_mode(crypt_info, inode); |
| 586 | if (IS_ERR(mode)) { |
| 587 | res = PTR_ERR(mode); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 588 | goto out; |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 589 | } |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 590 | WARN_ON(mode->ivsize > FSCRYPT_MAX_IV_SIZE); |
| 591 | crypt_info->ci_mode = mode; |
Eric Biggers | 8f39850 | 2016-09-15 13:32:11 -0400 | [diff] [blame] | 592 | |
Eric Biggers | a6e0891 | 2016-11-13 20:41:09 -0500 | [diff] [blame] | 593 | /* |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 594 | * This cannot be a stack buffer because it may be passed to the |
| 595 | * scatterlist crypto API as part of key derivation. |
Eric Biggers | a6e0891 | 2016-11-13 20:41:09 -0500 | [diff] [blame] | 596 | */ |
| 597 | res = -ENOMEM; |
Eric Biggers | e1cc40e | 2018-05-18 10:58:14 -0700 | [diff] [blame] | 598 | raw_key = kmalloc(mode->keysize, GFP_NOFS); |
Eric Biggers | a6e0891 | 2016-11-13 20:41:09 -0500 | [diff] [blame] | 599 | if (!raw_key) |
| 600 | goto out; |
| 601 | |
Eric Biggers | 78d7a79 | 2018-11-26 11:27:37 -0800 | [diff] [blame] | 602 | res = find_and_derive_key(inode, &ctx, raw_key, mode); |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 603 | if (res) |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 604 | goto out; |
Eric Biggers | 590f497 | 2018-04-30 15:51:48 -0700 | [diff] [blame] | 605 | |
Zhen Kong | ee7bdc6 | 2019-03-14 10:55:19 -0700 | [diff] [blame^] | 606 | if (!mode->inline_encryption) { |
| 607 | res = setup_crypto_transform(crypt_info, mode, raw_key, inode); |
| 608 | if (res) |
| 609 | goto out; |
| 610 | } else { |
| 611 | memcpy(crypt_info->ci_raw_key, raw_key, mode->keysize); |
| 612 | } |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 613 | |
Eric Biggers | 1b53cf9 | 2017-02-21 15:07:11 -0800 | [diff] [blame] | 614 | if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) == NULL) |
| 615 | crypt_info = NULL; |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 616 | out: |
| 617 | if (res == -ENOKEY) |
| 618 | res = 0; |
| 619 | put_crypt_info(crypt_info); |
Eric Biggers | a6e0891 | 2016-11-13 20:41:09 -0500 | [diff] [blame] | 620 | kzfree(raw_key); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 621 | return res; |
| 622 | } |
Eric Biggers | 1b53cf9 | 2017-02-21 15:07:11 -0800 | [diff] [blame] | 623 | EXPORT_SYMBOL(fscrypt_get_encryption_info); |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 624 | |
Eric Biggers | 3d204e2 | 2018-01-11 23:30:13 -0500 | [diff] [blame] | 625 | void fscrypt_put_encryption_info(struct inode *inode) |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 626 | { |
Eric Biggers | 3d204e2 | 2018-01-11 23:30:13 -0500 | [diff] [blame] | 627 | put_crypt_info(inode->i_crypt_info); |
| 628 | inode->i_crypt_info = NULL; |
Jaegeuk Kim | 0b81d07 | 2015-05-15 16:26:10 -0700 | [diff] [blame] | 629 | } |
| 630 | EXPORT_SYMBOL(fscrypt_put_encryption_info); |