![Linus Torvalds](/assets/img/avatar_default.png)
This reverts merge0f75ef6a9c
(and thus effectively commits7a1ade8475
("keys: Provide KEYCTL_GRANT_PERMISSION")2e12256b9a
("keys: Replace uid/gid/perm permissions checking with an ACL") that the merge brought in). It turns out that it breaks booting with an encrypted volume, and Eric biggers reports that it also breaks the fscrypt tests [1] and loading of in-kernel X.509 certificates [2]. The root cause of all the breakage is likely the same, but David Howells is off email so rather than try to work it out it's getting reverted in order to not impact the rest of the merge window. [1] https://lore.kernel.org/lkml/20190710011559.GA7973@sol.localdomain/ [2] https://lore.kernel.org/lkml/20190710013225.GB7973@sol.localdomain/ Link: https://lore.kernel.org/lkml/CAHk-=wjxoeMJfeBahnWH=9zShKp2bsVy527vo3_y8HfOdhwAAw@mail.gmail.com/ Reported-by: Eric Biggers <ebiggers@kernel.org> Cc: David Howells <dhowells@redhat.com> Cc: James Morris <jmorris@namei.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1024 lines
26 KiB
C
1024 lines
26 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Copyright (C) 2010 IBM Corporation
|
|
* Copyright (C) 2010 Politecnico di Torino, Italy
|
|
* TORSEC group -- http://security.polito.it
|
|
*
|
|
* Authors:
|
|
* Mimi Zohar <zohar@us.ibm.com>
|
|
* Roberto Sassu <roberto.sassu@polito.it>
|
|
*
|
|
* See Documentation/security/keys/trusted-encrypted.rst
|
|
*/
|
|
|
|
#include <linux/uaccess.h>
|
|
#include <linux/module.h>
|
|
#include <linux/init.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/parser.h>
|
|
#include <linux/string.h>
|
|
#include <linux/err.h>
|
|
#include <keys/user-type.h>
|
|
#include <keys/trusted-type.h>
|
|
#include <keys/encrypted-type.h>
|
|
#include <linux/key-type.h>
|
|
#include <linux/random.h>
|
|
#include <linux/rcupdate.h>
|
|
#include <linux/scatterlist.h>
|
|
#include <linux/ctype.h>
|
|
#include <crypto/aes.h>
|
|
#include <crypto/algapi.h>
|
|
#include <crypto/hash.h>
|
|
#include <crypto/sha.h>
|
|
#include <crypto/skcipher.h>
|
|
|
|
#include "encrypted.h"
|
|
#include "ecryptfs_format.h"
|
|
|
|
static const char KEY_TRUSTED_PREFIX[] = "trusted:";
|
|
static const char KEY_USER_PREFIX[] = "user:";
|
|
static const char hash_alg[] = "sha256";
|
|
static const char hmac_alg[] = "hmac(sha256)";
|
|
static const char blkcipher_alg[] = "cbc(aes)";
|
|
static const char key_format_default[] = "default";
|
|
static const char key_format_ecryptfs[] = "ecryptfs";
|
|
static const char key_format_enc32[] = "enc32";
|
|
static unsigned int ivsize;
|
|
static int blksize;
|
|
|
|
#define KEY_TRUSTED_PREFIX_LEN (sizeof (KEY_TRUSTED_PREFIX) - 1)
|
|
#define KEY_USER_PREFIX_LEN (sizeof (KEY_USER_PREFIX) - 1)
|
|
#define KEY_ECRYPTFS_DESC_LEN 16
|
|
#define HASH_SIZE SHA256_DIGEST_SIZE
|
|
#define MAX_DATA_SIZE 4096
|
|
#define MIN_DATA_SIZE 20
|
|
#define KEY_ENC32_PAYLOAD_LEN 32
|
|
|
|
static struct crypto_shash *hash_tfm;
|
|
|
|
enum {
|
|
Opt_new, Opt_load, Opt_update, Opt_err
|
|
};
|
|
|
|
enum {
|
|
Opt_default, Opt_ecryptfs, Opt_enc32, Opt_error
|
|
};
|
|
|
|
static const match_table_t key_format_tokens = {
|
|
{Opt_default, "default"},
|
|
{Opt_ecryptfs, "ecryptfs"},
|
|
{Opt_enc32, "enc32"},
|
|
{Opt_error, NULL}
|
|
};
|
|
|
|
static const match_table_t key_tokens = {
|
|
{Opt_new, "new"},
|
|
{Opt_load, "load"},
|
|
{Opt_update, "update"},
|
|
{Opt_err, NULL}
|
|
};
|
|
|
|
static int aes_get_sizes(void)
|
|
{
|
|
struct crypto_skcipher *tfm;
|
|
|
|
tfm = crypto_alloc_skcipher(blkcipher_alg, 0, CRYPTO_ALG_ASYNC);
|
|
if (IS_ERR(tfm)) {
|
|
pr_err("encrypted_key: failed to alloc_cipher (%ld)\n",
|
|
PTR_ERR(tfm));
|
|
return PTR_ERR(tfm);
|
|
}
|
|
ivsize = crypto_skcipher_ivsize(tfm);
|
|
blksize = crypto_skcipher_blocksize(tfm);
|
|
crypto_free_skcipher(tfm);
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* valid_ecryptfs_desc - verify the description of a new/loaded encrypted key
|
|
*
|
|
* The description of a encrypted key with format 'ecryptfs' must contain
|
|
* exactly 16 hexadecimal characters.
|
|
*
|
|
*/
|
|
static int valid_ecryptfs_desc(const char *ecryptfs_desc)
|
|
{
|
|
int i;
|
|
|
|
if (strlen(ecryptfs_desc) != KEY_ECRYPTFS_DESC_LEN) {
|
|
pr_err("encrypted_key: key description must be %d hexadecimal "
|
|
"characters long\n", KEY_ECRYPTFS_DESC_LEN);
|
|
return -EINVAL;
|
|
}
|
|
|
|
for (i = 0; i < KEY_ECRYPTFS_DESC_LEN; i++) {
|
|
if (!isxdigit(ecryptfs_desc[i])) {
|
|
pr_err("encrypted_key: key description must contain "
|
|
"only hexadecimal characters\n");
|
|
return -EINVAL;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* valid_master_desc - verify the 'key-type:desc' of a new/updated master-key
|
|
*
|
|
* key-type:= "trusted:" | "user:"
|
|
* desc:= master-key description
|
|
*
|
|
* Verify that 'key-type' is valid and that 'desc' exists. On key update,
|
|
* only the master key description is permitted to change, not the key-type.
|
|
* The key-type remains constant.
|
|
*
|
|
* On success returns 0, otherwise -EINVAL.
|
|
*/
|
|
static int valid_master_desc(const char *new_desc, const char *orig_desc)
|
|
{
|
|
int prefix_len;
|
|
|
|
if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN))
|
|
prefix_len = KEY_TRUSTED_PREFIX_LEN;
|
|
else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN))
|
|
prefix_len = KEY_USER_PREFIX_LEN;
|
|
else
|
|
return -EINVAL;
|
|
|
|
if (!new_desc[prefix_len])
|
|
return -EINVAL;
|
|
|
|
if (orig_desc && strncmp(new_desc, orig_desc, prefix_len))
|
|
return -EINVAL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* datablob_parse - parse the keyctl data
|
|
*
|
|
* datablob format:
|
|
* new [<format>] <master-key name> <decrypted data length>
|
|
* load [<format>] <master-key name> <decrypted data length>
|
|
* <encrypted iv + data>
|
|
* update <new-master-key name>
|
|
*
|
|
* Tokenizes a copy of the keyctl data, returning a pointer to each token,
|
|
* which is null terminated.
|
|
*
|
|
* On success returns 0, otherwise -EINVAL.
|
|
*/
|
|
static int datablob_parse(char *datablob, const char **format,
|
|
char **master_desc, char **decrypted_datalen,
|
|
char **hex_encoded_iv)
|
|
{
|
|
substring_t args[MAX_OPT_ARGS];
|
|
int ret = -EINVAL;
|
|
int key_cmd;
|
|
int key_format;
|
|
char *p, *keyword;
|
|
|
|
keyword = strsep(&datablob, " \t");
|
|
if (!keyword) {
|
|
pr_info("encrypted_key: insufficient parameters specified\n");
|
|
return ret;
|
|
}
|
|
key_cmd = match_token(keyword, key_tokens, args);
|
|
|
|
/* Get optional format: default | ecryptfs */
|
|
p = strsep(&datablob, " \t");
|
|
if (!p) {
|
|
pr_err("encrypted_key: insufficient parameters specified\n");
|
|
return ret;
|
|
}
|
|
|
|
key_format = match_token(p, key_format_tokens, args);
|
|
switch (key_format) {
|
|
case Opt_ecryptfs:
|
|
case Opt_enc32:
|
|
case Opt_default:
|
|
*format = p;
|
|
*master_desc = strsep(&datablob, " \t");
|
|
break;
|
|
case Opt_error:
|
|
*master_desc = p;
|
|
break;
|
|
}
|
|
|
|
if (!*master_desc) {
|
|
pr_info("encrypted_key: master key parameter is missing\n");
|
|
goto out;
|
|
}
|
|
|
|
if (valid_master_desc(*master_desc, NULL) < 0) {
|
|
pr_info("encrypted_key: master key parameter \'%s\' "
|
|
"is invalid\n", *master_desc);
|
|
goto out;
|
|
}
|
|
|
|
if (decrypted_datalen) {
|
|
*decrypted_datalen = strsep(&datablob, " \t");
|
|
if (!*decrypted_datalen) {
|
|
pr_info("encrypted_key: keylen parameter is missing\n");
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
switch (key_cmd) {
|
|
case Opt_new:
|
|
if (!decrypted_datalen) {
|
|
pr_info("encrypted_key: keyword \'%s\' not allowed "
|
|
"when called from .update method\n", keyword);
|
|
break;
|
|
}
|
|
ret = 0;
|
|
break;
|
|
case Opt_load:
|
|
if (!decrypted_datalen) {
|
|
pr_info("encrypted_key: keyword \'%s\' not allowed "
|
|
"when called from .update method\n", keyword);
|
|
break;
|
|
}
|
|
*hex_encoded_iv = strsep(&datablob, " \t");
|
|
if (!*hex_encoded_iv) {
|
|
pr_info("encrypted_key: hex blob is missing\n");
|
|
break;
|
|
}
|
|
ret = 0;
|
|
break;
|
|
case Opt_update:
|
|
if (decrypted_datalen) {
|
|
pr_info("encrypted_key: keyword \'%s\' not allowed "
|
|
"when called from .instantiate method\n",
|
|
keyword);
|
|
break;
|
|
}
|
|
ret = 0;
|
|
break;
|
|
case Opt_err:
|
|
pr_info("encrypted_key: keyword \'%s\' not recognized\n",
|
|
keyword);
|
|
break;
|
|
}
|
|
out:
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* datablob_format - format as an ascii string, before copying to userspace
|
|
*/
|
|
static char *datablob_format(struct encrypted_key_payload *epayload,
|
|
size_t asciiblob_len)
|
|
{
|
|
char *ascii_buf, *bufp;
|
|
u8 *iv = epayload->iv;
|
|
int len;
|
|
int i;
|
|
|
|
ascii_buf = kmalloc(asciiblob_len + 1, GFP_KERNEL);
|
|
if (!ascii_buf)
|
|
goto out;
|
|
|
|
ascii_buf[asciiblob_len] = '\0';
|
|
|
|
/* copy datablob master_desc and datalen strings */
|
|
len = sprintf(ascii_buf, "%s %s %s ", epayload->format,
|
|
epayload->master_desc, epayload->datalen);
|
|
|
|
/* convert the hex encoded iv, encrypted-data and HMAC to ascii */
|
|
bufp = &ascii_buf[len];
|
|
for (i = 0; i < (asciiblob_len - len) / 2; i++)
|
|
bufp = hex_byte_pack(bufp, iv[i]);
|
|
out:
|
|
return ascii_buf;
|
|
}
|
|
|
|
/*
|
|
* request_user_key - request the user key
|
|
*
|
|
* Use a user provided key to encrypt/decrypt an encrypted-key.
|
|
*/
|
|
static struct key *request_user_key(const char *master_desc, const u8 **master_key,
|
|
size_t *master_keylen)
|
|
{
|
|
const struct user_key_payload *upayload;
|
|
struct key *ukey;
|
|
|
|
ukey = request_key(&key_type_user, master_desc, NULL);
|
|
if (IS_ERR(ukey))
|
|
goto error;
|
|
|
|
down_read(&ukey->sem);
|
|
upayload = user_key_payload_locked(ukey);
|
|
if (!upayload) {
|
|
/* key was revoked before we acquired its semaphore */
|
|
up_read(&ukey->sem);
|
|
key_put(ukey);
|
|
ukey = ERR_PTR(-EKEYREVOKED);
|
|
goto error;
|
|
}
|
|
*master_key = upayload->data;
|
|
*master_keylen = upayload->datalen;
|
|
error:
|
|
return ukey;
|
|
}
|
|
|
|
static int calc_hash(struct crypto_shash *tfm, u8 *digest,
|
|
const u8 *buf, unsigned int buflen)
|
|
{
|
|
SHASH_DESC_ON_STACK(desc, tfm);
|
|
int err;
|
|
|
|
desc->tfm = tfm;
|
|
|
|
err = crypto_shash_digest(desc, buf, buflen, digest);
|
|
shash_desc_zero(desc);
|
|
return err;
|
|
}
|
|
|
|
static int calc_hmac(u8 *digest, const u8 *key, unsigned int keylen,
|
|
const u8 *buf, unsigned int buflen)
|
|
{
|
|
struct crypto_shash *tfm;
|
|
int err;
|
|
|
|
tfm = crypto_alloc_shash(hmac_alg, 0, 0);
|
|
if (IS_ERR(tfm)) {
|
|
pr_err("encrypted_key: can't alloc %s transform: %ld\n",
|
|
hmac_alg, PTR_ERR(tfm));
|
|
return PTR_ERR(tfm);
|
|
}
|
|
|
|
err = crypto_shash_setkey(tfm, key, keylen);
|
|
if (!err)
|
|
err = calc_hash(tfm, digest, buf, buflen);
|
|
crypto_free_shash(tfm);
|
|
return err;
|
|
}
|
|
|
|
enum derived_key_type { ENC_KEY, AUTH_KEY };
|
|
|
|
/* Derive authentication/encryption key from trusted key */
|
|
static int get_derived_key(u8 *derived_key, enum derived_key_type key_type,
|
|
const u8 *master_key, size_t master_keylen)
|
|
{
|
|
u8 *derived_buf;
|
|
unsigned int derived_buf_len;
|
|
int ret;
|
|
|
|
derived_buf_len = strlen("AUTH_KEY") + 1 + master_keylen;
|
|
if (derived_buf_len < HASH_SIZE)
|
|
derived_buf_len = HASH_SIZE;
|
|
|
|
derived_buf = kzalloc(derived_buf_len, GFP_KERNEL);
|
|
if (!derived_buf)
|
|
return -ENOMEM;
|
|
|
|
if (key_type)
|
|
strcpy(derived_buf, "AUTH_KEY");
|
|
else
|
|
strcpy(derived_buf, "ENC_KEY");
|
|
|
|
memcpy(derived_buf + strlen(derived_buf) + 1, master_key,
|
|
master_keylen);
|
|
ret = calc_hash(hash_tfm, derived_key, derived_buf, derived_buf_len);
|
|
kzfree(derived_buf);
|
|
return ret;
|
|
}
|
|
|
|
static struct skcipher_request *init_skcipher_req(const u8 *key,
|
|
unsigned int key_len)
|
|
{
|
|
struct skcipher_request *req;
|
|
struct crypto_skcipher *tfm;
|
|
int ret;
|
|
|
|
tfm = crypto_alloc_skcipher(blkcipher_alg, 0, CRYPTO_ALG_ASYNC);
|
|
if (IS_ERR(tfm)) {
|
|
pr_err("encrypted_key: failed to load %s transform (%ld)\n",
|
|
blkcipher_alg, PTR_ERR(tfm));
|
|
return ERR_CAST(tfm);
|
|
}
|
|
|
|
ret = crypto_skcipher_setkey(tfm, key, key_len);
|
|
if (ret < 0) {
|
|
pr_err("encrypted_key: failed to setkey (%d)\n", ret);
|
|
crypto_free_skcipher(tfm);
|
|
return ERR_PTR(ret);
|
|
}
|
|
|
|
req = skcipher_request_alloc(tfm, GFP_KERNEL);
|
|
if (!req) {
|
|
pr_err("encrypted_key: failed to allocate request for %s\n",
|
|
blkcipher_alg);
|
|
crypto_free_skcipher(tfm);
|
|
return ERR_PTR(-ENOMEM);
|
|
}
|
|
|
|
skcipher_request_set_callback(req, 0, NULL, NULL);
|
|
return req;
|
|
}
|
|
|
|
static struct key *request_master_key(struct encrypted_key_payload *epayload,
|
|
const u8 **master_key, size_t *master_keylen)
|
|
{
|
|
struct key *mkey = ERR_PTR(-EINVAL);
|
|
|
|
if (!strncmp(epayload->master_desc, KEY_TRUSTED_PREFIX,
|
|
KEY_TRUSTED_PREFIX_LEN)) {
|
|
mkey = request_trusted_key(epayload->master_desc +
|
|
KEY_TRUSTED_PREFIX_LEN,
|
|
master_key, master_keylen);
|
|
} else if (!strncmp(epayload->master_desc, KEY_USER_PREFIX,
|
|
KEY_USER_PREFIX_LEN)) {
|
|
mkey = request_user_key(epayload->master_desc +
|
|
KEY_USER_PREFIX_LEN,
|
|
master_key, master_keylen);
|
|
} else
|
|
goto out;
|
|
|
|
if (IS_ERR(mkey)) {
|
|
int ret = PTR_ERR(mkey);
|
|
|
|
if (ret == -ENOTSUPP)
|
|
pr_info("encrypted_key: key %s not supported",
|
|
epayload->master_desc);
|
|
else
|
|
pr_info("encrypted_key: key %s not found",
|
|
epayload->master_desc);
|
|
goto out;
|
|
}
|
|
|
|
dump_master_key(*master_key, *master_keylen);
|
|
out:
|
|
return mkey;
|
|
}
|
|
|
|
/* Before returning data to userspace, encrypt decrypted data. */
|
|
static int derived_key_encrypt(struct encrypted_key_payload *epayload,
|
|
const u8 *derived_key,
|
|
unsigned int derived_keylen)
|
|
{
|
|
struct scatterlist sg_in[2];
|
|
struct scatterlist sg_out[1];
|
|
struct crypto_skcipher *tfm;
|
|
struct skcipher_request *req;
|
|
unsigned int encrypted_datalen;
|
|
u8 iv[AES_BLOCK_SIZE];
|
|
int ret;
|
|
|
|
encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
|
|
|
|
req = init_skcipher_req(derived_key, derived_keylen);
|
|
ret = PTR_ERR(req);
|
|
if (IS_ERR(req))
|
|
goto out;
|
|
dump_decrypted_data(epayload);
|
|
|
|
sg_init_table(sg_in, 2);
|
|
sg_set_buf(&sg_in[0], epayload->decrypted_data,
|
|
epayload->decrypted_datalen);
|
|
sg_set_page(&sg_in[1], ZERO_PAGE(0), AES_BLOCK_SIZE, 0);
|
|
|
|
sg_init_table(sg_out, 1);
|
|
sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
|
|
|
|
memcpy(iv, epayload->iv, sizeof(iv));
|
|
skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
|
|
ret = crypto_skcipher_encrypt(req);
|
|
tfm = crypto_skcipher_reqtfm(req);
|
|
skcipher_request_free(req);
|
|
crypto_free_skcipher(tfm);
|
|
if (ret < 0)
|
|
pr_err("encrypted_key: failed to encrypt (%d)\n", ret);
|
|
else
|
|
dump_encrypted_data(epayload, encrypted_datalen);
|
|
out:
|
|
return ret;
|
|
}
|
|
|
|
static int datablob_hmac_append(struct encrypted_key_payload *epayload,
|
|
const u8 *master_key, size_t master_keylen)
|
|
{
|
|
u8 derived_key[HASH_SIZE];
|
|
u8 *digest;
|
|
int ret;
|
|
|
|
ret = get_derived_key(derived_key, AUTH_KEY, master_key, master_keylen);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
digest = epayload->format + epayload->datablob_len;
|
|
ret = calc_hmac(digest, derived_key, sizeof derived_key,
|
|
epayload->format, epayload->datablob_len);
|
|
if (!ret)
|
|
dump_hmac(NULL, digest, HASH_SIZE);
|
|
out:
|
|
memzero_explicit(derived_key, sizeof(derived_key));
|
|
return ret;
|
|
}
|
|
|
|
/* verify HMAC before decrypting encrypted key */
|
|
static int datablob_hmac_verify(struct encrypted_key_payload *epayload,
|
|
const u8 *format, const u8 *master_key,
|
|
size_t master_keylen)
|
|
{
|
|
u8 derived_key[HASH_SIZE];
|
|
u8 digest[HASH_SIZE];
|
|
int ret;
|
|
char *p;
|
|
unsigned short len;
|
|
|
|
ret = get_derived_key(derived_key, AUTH_KEY, master_key, master_keylen);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
len = epayload->datablob_len;
|
|
if (!format) {
|
|
p = epayload->master_desc;
|
|
len -= strlen(epayload->format) + 1;
|
|
} else
|
|
p = epayload->format;
|
|
|
|
ret = calc_hmac(digest, derived_key, sizeof derived_key, p, len);
|
|
if (ret < 0)
|
|
goto out;
|
|
ret = crypto_memneq(digest, epayload->format + epayload->datablob_len,
|
|
sizeof(digest));
|
|
if (ret) {
|
|
ret = -EINVAL;
|
|
dump_hmac("datablob",
|
|
epayload->format + epayload->datablob_len,
|
|
HASH_SIZE);
|
|
dump_hmac("calc", digest, HASH_SIZE);
|
|
}
|
|
out:
|
|
memzero_explicit(derived_key, sizeof(derived_key));
|
|
return ret;
|
|
}
|
|
|
|
static int derived_key_decrypt(struct encrypted_key_payload *epayload,
|
|
const u8 *derived_key,
|
|
unsigned int derived_keylen)
|
|
{
|
|
struct scatterlist sg_in[1];
|
|
struct scatterlist sg_out[2];
|
|
struct crypto_skcipher *tfm;
|
|
struct skcipher_request *req;
|
|
unsigned int encrypted_datalen;
|
|
u8 iv[AES_BLOCK_SIZE];
|
|
u8 *pad;
|
|
int ret;
|
|
|
|
/* Throwaway buffer to hold the unused zero padding at the end */
|
|
pad = kmalloc(AES_BLOCK_SIZE, GFP_KERNEL);
|
|
if (!pad)
|
|
return -ENOMEM;
|
|
|
|
encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
|
|
req = init_skcipher_req(derived_key, derived_keylen);
|
|
ret = PTR_ERR(req);
|
|
if (IS_ERR(req))
|
|
goto out;
|
|
dump_encrypted_data(epayload, encrypted_datalen);
|
|
|
|
sg_init_table(sg_in, 1);
|
|
sg_init_table(sg_out, 2);
|
|
sg_set_buf(sg_in, epayload->encrypted_data, encrypted_datalen);
|
|
sg_set_buf(&sg_out[0], epayload->decrypted_data,
|
|
epayload->decrypted_datalen);
|
|
sg_set_buf(&sg_out[1], pad, AES_BLOCK_SIZE);
|
|
|
|
memcpy(iv, epayload->iv, sizeof(iv));
|
|
skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
|
|
ret = crypto_skcipher_decrypt(req);
|
|
tfm = crypto_skcipher_reqtfm(req);
|
|
skcipher_request_free(req);
|
|
crypto_free_skcipher(tfm);
|
|
if (ret < 0)
|
|
goto out;
|
|
dump_decrypted_data(epayload);
|
|
out:
|
|
kfree(pad);
|
|
return ret;
|
|
}
|
|
|
|
/* Allocate memory for decrypted key and datablob. */
|
|
static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
|
|
const char *format,
|
|
const char *master_desc,
|
|
const char *datalen)
|
|
{
|
|
struct encrypted_key_payload *epayload = NULL;
|
|
unsigned short datablob_len;
|
|
unsigned short decrypted_datalen;
|
|
unsigned short payload_datalen;
|
|
unsigned int encrypted_datalen;
|
|
unsigned int format_len;
|
|
long dlen;
|
|
int ret;
|
|
|
|
ret = kstrtol(datalen, 10, &dlen);
|
|
if (ret < 0 || dlen < MIN_DATA_SIZE || dlen > MAX_DATA_SIZE)
|
|
return ERR_PTR(-EINVAL);
|
|
|
|
format_len = (!format) ? strlen(key_format_default) : strlen(format);
|
|
decrypted_datalen = dlen;
|
|
payload_datalen = decrypted_datalen;
|
|
if (format) {
|
|
if (!strcmp(format, key_format_ecryptfs)) {
|
|
if (dlen != ECRYPTFS_MAX_KEY_BYTES) {
|
|
pr_err("encrypted_key: keylen for the ecryptfs format must be equal to %d bytes\n",
|
|
ECRYPTFS_MAX_KEY_BYTES);
|
|
return ERR_PTR(-EINVAL);
|
|
}
|
|
decrypted_datalen = ECRYPTFS_MAX_KEY_BYTES;
|
|
payload_datalen = sizeof(struct ecryptfs_auth_tok);
|
|
} else if (!strcmp(format, key_format_enc32)) {
|
|
if (decrypted_datalen != KEY_ENC32_PAYLOAD_LEN) {
|
|
pr_err("encrypted_key: enc32 key payload incorrect length: %d\n",
|
|
decrypted_datalen);
|
|
return ERR_PTR(-EINVAL);
|
|
}
|
|
}
|
|
}
|
|
|
|
encrypted_datalen = roundup(decrypted_datalen, blksize);
|
|
|
|
datablob_len = format_len + 1 + strlen(master_desc) + 1
|
|
+ strlen(datalen) + 1 + ivsize + 1 + encrypted_datalen;
|
|
|
|
ret = key_payload_reserve(key, payload_datalen + datablob_len
|
|
+ HASH_SIZE + 1);
|
|
if (ret < 0)
|
|
return ERR_PTR(ret);
|
|
|
|
epayload = kzalloc(sizeof(*epayload) + payload_datalen +
|
|
datablob_len + HASH_SIZE + 1, GFP_KERNEL);
|
|
if (!epayload)
|
|
return ERR_PTR(-ENOMEM);
|
|
|
|
epayload->payload_datalen = payload_datalen;
|
|
epayload->decrypted_datalen = decrypted_datalen;
|
|
epayload->datablob_len = datablob_len;
|
|
return epayload;
|
|
}
|
|
|
|
static int encrypted_key_decrypt(struct encrypted_key_payload *epayload,
|
|
const char *format, const char *hex_encoded_iv)
|
|
{
|
|
struct key *mkey;
|
|
u8 derived_key[HASH_SIZE];
|
|
const u8 *master_key;
|
|
u8 *hmac;
|
|
const char *hex_encoded_data;
|
|
unsigned int encrypted_datalen;
|
|
size_t master_keylen;
|
|
size_t asciilen;
|
|
int ret;
|
|
|
|
encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
|
|
asciilen = (ivsize + 1 + encrypted_datalen + HASH_SIZE) * 2;
|
|
if (strlen(hex_encoded_iv) != asciilen)
|
|
return -EINVAL;
|
|
|
|
hex_encoded_data = hex_encoded_iv + (2 * ivsize) + 2;
|
|
ret = hex2bin(epayload->iv, hex_encoded_iv, ivsize);
|
|
if (ret < 0)
|
|
return -EINVAL;
|
|
ret = hex2bin(epayload->encrypted_data, hex_encoded_data,
|
|
encrypted_datalen);
|
|
if (ret < 0)
|
|
return -EINVAL;
|
|
|
|
hmac = epayload->format + epayload->datablob_len;
|
|
ret = hex2bin(hmac, hex_encoded_data + (encrypted_datalen * 2),
|
|
HASH_SIZE);
|
|
if (ret < 0)
|
|
return -EINVAL;
|
|
|
|
mkey = request_master_key(epayload, &master_key, &master_keylen);
|
|
if (IS_ERR(mkey))
|
|
return PTR_ERR(mkey);
|
|
|
|
ret = datablob_hmac_verify(epayload, format, master_key, master_keylen);
|
|
if (ret < 0) {
|
|
pr_err("encrypted_key: bad hmac (%d)\n", ret);
|
|
goto out;
|
|
}
|
|
|
|
ret = get_derived_key(derived_key, ENC_KEY, master_key, master_keylen);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
ret = derived_key_decrypt(epayload, derived_key, sizeof derived_key);
|
|
if (ret < 0)
|
|
pr_err("encrypted_key: failed to decrypt key (%d)\n", ret);
|
|
out:
|
|
up_read(&mkey->sem);
|
|
key_put(mkey);
|
|
memzero_explicit(derived_key, sizeof(derived_key));
|
|
return ret;
|
|
}
|
|
|
|
static void __ekey_init(struct encrypted_key_payload *epayload,
|
|
const char *format, const char *master_desc,
|
|
const char *datalen)
|
|
{
|
|
unsigned int format_len;
|
|
|
|
format_len = (!format) ? strlen(key_format_default) : strlen(format);
|
|
epayload->format = epayload->payload_data + epayload->payload_datalen;
|
|
epayload->master_desc = epayload->format + format_len + 1;
|
|
epayload->datalen = epayload->master_desc + strlen(master_desc) + 1;
|
|
epayload->iv = epayload->datalen + strlen(datalen) + 1;
|
|
epayload->encrypted_data = epayload->iv + ivsize + 1;
|
|
epayload->decrypted_data = epayload->payload_data;
|
|
|
|
if (!format)
|
|
memcpy(epayload->format, key_format_default, format_len);
|
|
else {
|
|
if (!strcmp(format, key_format_ecryptfs))
|
|
epayload->decrypted_data =
|
|
ecryptfs_get_auth_tok_key((struct ecryptfs_auth_tok *)epayload->payload_data);
|
|
|
|
memcpy(epayload->format, format, format_len);
|
|
}
|
|
|
|
memcpy(epayload->master_desc, master_desc, strlen(master_desc));
|
|
memcpy(epayload->datalen, datalen, strlen(datalen));
|
|
}
|
|
|
|
/*
|
|
* encrypted_init - initialize an encrypted key
|
|
*
|
|
* For a new key, use a random number for both the iv and data
|
|
* itself. For an old key, decrypt the hex encoded data.
|
|
*/
|
|
static int encrypted_init(struct encrypted_key_payload *epayload,
|
|
const char *key_desc, const char *format,
|
|
const char *master_desc, const char *datalen,
|
|
const char *hex_encoded_iv)
|
|
{
|
|
int ret = 0;
|
|
|
|
if (format && !strcmp(format, key_format_ecryptfs)) {
|
|
ret = valid_ecryptfs_desc(key_desc);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
ecryptfs_fill_auth_tok((struct ecryptfs_auth_tok *)epayload->payload_data,
|
|
key_desc);
|
|
}
|
|
|
|
__ekey_init(epayload, format, master_desc, datalen);
|
|
if (!hex_encoded_iv) {
|
|
get_random_bytes(epayload->iv, ivsize);
|
|
|
|
get_random_bytes(epayload->decrypted_data,
|
|
epayload->decrypted_datalen);
|
|
} else
|
|
ret = encrypted_key_decrypt(epayload, format, hex_encoded_iv);
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* encrypted_instantiate - instantiate an encrypted key
|
|
*
|
|
* Decrypt an existing encrypted datablob or create a new encrypted key
|
|
* based on a kernel random number.
|
|
*
|
|
* On success, return 0. Otherwise return errno.
|
|
*/
|
|
static int encrypted_instantiate(struct key *key,
|
|
struct key_preparsed_payload *prep)
|
|
{
|
|
struct encrypted_key_payload *epayload = NULL;
|
|
char *datablob = NULL;
|
|
const char *format = NULL;
|
|
char *master_desc = NULL;
|
|
char *decrypted_datalen = NULL;
|
|
char *hex_encoded_iv = NULL;
|
|
size_t datalen = prep->datalen;
|
|
int ret;
|
|
|
|
if (datalen <= 0 || datalen > 32767 || !prep->data)
|
|
return -EINVAL;
|
|
|
|
datablob = kmalloc(datalen + 1, GFP_KERNEL);
|
|
if (!datablob)
|
|
return -ENOMEM;
|
|
datablob[datalen] = 0;
|
|
memcpy(datablob, prep->data, datalen);
|
|
ret = datablob_parse(datablob, &format, &master_desc,
|
|
&decrypted_datalen, &hex_encoded_iv);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
epayload = encrypted_key_alloc(key, format, master_desc,
|
|
decrypted_datalen);
|
|
if (IS_ERR(epayload)) {
|
|
ret = PTR_ERR(epayload);
|
|
goto out;
|
|
}
|
|
ret = encrypted_init(epayload, key->description, format, master_desc,
|
|
decrypted_datalen, hex_encoded_iv);
|
|
if (ret < 0) {
|
|
kzfree(epayload);
|
|
goto out;
|
|
}
|
|
|
|
rcu_assign_keypointer(key, epayload);
|
|
out:
|
|
kzfree(datablob);
|
|
return ret;
|
|
}
|
|
|
|
static void encrypted_rcu_free(struct rcu_head *rcu)
|
|
{
|
|
struct encrypted_key_payload *epayload;
|
|
|
|
epayload = container_of(rcu, struct encrypted_key_payload, rcu);
|
|
kzfree(epayload);
|
|
}
|
|
|
|
/*
|
|
* encrypted_update - update the master key description
|
|
*
|
|
* Change the master key description for an existing encrypted key.
|
|
* The next read will return an encrypted datablob using the new
|
|
* master key description.
|
|
*
|
|
* On success, return 0. Otherwise return errno.
|
|
*/
|
|
static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
|
|
{
|
|
struct encrypted_key_payload *epayload = key->payload.data[0];
|
|
struct encrypted_key_payload *new_epayload;
|
|
char *buf;
|
|
char *new_master_desc = NULL;
|
|
const char *format = NULL;
|
|
size_t datalen = prep->datalen;
|
|
int ret = 0;
|
|
|
|
if (key_is_negative(key))
|
|
return -ENOKEY;
|
|
if (datalen <= 0 || datalen > 32767 || !prep->data)
|
|
return -EINVAL;
|
|
|
|
buf = kmalloc(datalen + 1, GFP_KERNEL);
|
|
if (!buf)
|
|
return -ENOMEM;
|
|
|
|
buf[datalen] = 0;
|
|
memcpy(buf, prep->data, datalen);
|
|
ret = datablob_parse(buf, &format, &new_master_desc, NULL, NULL);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
ret = valid_master_desc(new_master_desc, epayload->master_desc);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
new_epayload = encrypted_key_alloc(key, epayload->format,
|
|
new_master_desc, epayload->datalen);
|
|
if (IS_ERR(new_epayload)) {
|
|
ret = PTR_ERR(new_epayload);
|
|
goto out;
|
|
}
|
|
|
|
__ekey_init(new_epayload, epayload->format, new_master_desc,
|
|
epayload->datalen);
|
|
|
|
memcpy(new_epayload->iv, epayload->iv, ivsize);
|
|
memcpy(new_epayload->payload_data, epayload->payload_data,
|
|
epayload->payload_datalen);
|
|
|
|
rcu_assign_keypointer(key, new_epayload);
|
|
call_rcu(&epayload->rcu, encrypted_rcu_free);
|
|
out:
|
|
kzfree(buf);
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* encrypted_read - format and copy the encrypted data to userspace
|
|
*
|
|
* The resulting datablob format is:
|
|
* <master-key name> <decrypted data length> <encrypted iv> <encrypted data>
|
|
*
|
|
* On success, return to userspace the encrypted key datablob size.
|
|
*/
|
|
static long encrypted_read(const struct key *key, char __user *buffer,
|
|
size_t buflen)
|
|
{
|
|
struct encrypted_key_payload *epayload;
|
|
struct key *mkey;
|
|
const u8 *master_key;
|
|
size_t master_keylen;
|
|
char derived_key[HASH_SIZE];
|
|
char *ascii_buf;
|
|
size_t asciiblob_len;
|
|
int ret;
|
|
|
|
epayload = dereference_key_locked(key);
|
|
|
|
/* returns the hex encoded iv, encrypted-data, and hmac as ascii */
|
|
asciiblob_len = epayload->datablob_len + ivsize + 1
|
|
+ roundup(epayload->decrypted_datalen, blksize)
|
|
+ (HASH_SIZE * 2);
|
|
|
|
if (!buffer || buflen < asciiblob_len)
|
|
return asciiblob_len;
|
|
|
|
mkey = request_master_key(epayload, &master_key, &master_keylen);
|
|
if (IS_ERR(mkey))
|
|
return PTR_ERR(mkey);
|
|
|
|
ret = get_derived_key(derived_key, ENC_KEY, master_key, master_keylen);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
ret = derived_key_encrypt(epayload, derived_key, sizeof derived_key);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
ret = datablob_hmac_append(epayload, master_key, master_keylen);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
ascii_buf = datablob_format(epayload, asciiblob_len);
|
|
if (!ascii_buf) {
|
|
ret = -ENOMEM;
|
|
goto out;
|
|
}
|
|
|
|
up_read(&mkey->sem);
|
|
key_put(mkey);
|
|
memzero_explicit(derived_key, sizeof(derived_key));
|
|
|
|
if (copy_to_user(buffer, ascii_buf, asciiblob_len) != 0)
|
|
ret = -EFAULT;
|
|
kzfree(ascii_buf);
|
|
|
|
return asciiblob_len;
|
|
out:
|
|
up_read(&mkey->sem);
|
|
key_put(mkey);
|
|
memzero_explicit(derived_key, sizeof(derived_key));
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* encrypted_destroy - clear and free the key's payload
|
|
*/
|
|
static void encrypted_destroy(struct key *key)
|
|
{
|
|
kzfree(key->payload.data[0]);
|
|
}
|
|
|
|
struct key_type key_type_encrypted = {
|
|
.name = "encrypted",
|
|
.instantiate = encrypted_instantiate,
|
|
.update = encrypted_update,
|
|
.destroy = encrypted_destroy,
|
|
.describe = user_describe,
|
|
.read = encrypted_read,
|
|
};
|
|
EXPORT_SYMBOL_GPL(key_type_encrypted);
|
|
|
|
static int __init init_encrypted(void)
|
|
{
|
|
int ret;
|
|
|
|
hash_tfm = crypto_alloc_shash(hash_alg, 0, 0);
|
|
if (IS_ERR(hash_tfm)) {
|
|
pr_err("encrypted_key: can't allocate %s transform: %ld\n",
|
|
hash_alg, PTR_ERR(hash_tfm));
|
|
return PTR_ERR(hash_tfm);
|
|
}
|
|
|
|
ret = aes_get_sizes();
|
|
if (ret < 0)
|
|
goto out;
|
|
ret = register_key_type(&key_type_encrypted);
|
|
if (ret < 0)
|
|
goto out;
|
|
return 0;
|
|
out:
|
|
crypto_free_shash(hash_tfm);
|
|
return ret;
|
|
|
|
}
|
|
|
|
static void __exit cleanup_encrypted(void)
|
|
{
|
|
crypto_free_shash(hash_tfm);
|
|
unregister_key_type(&key_type_encrypted);
|
|
}
|
|
|
|
late_initcall(init_encrypted);
|
|
module_exit(cleanup_encrypted);
|
|
|
|
MODULE_LICENSE("GPL");
|