projects/linux·blob master · refs

1010 lines · 26.5 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (C) 2010 IBM Corporation
4 * Copyright (C) 2010 Politecnico di Torino, Italy
5 * TORSEC group -- https://security.polito.it
6 *
7 * Authors:
8 * Mimi Zohar <[email protected]>
9 * Roberto Sassu <[email protected]>
10 *
11 * See Documentation/security/keys/trusted-encrypted.rst
12 */
13
14#include <linux/uaccess.h>
15#include <linux/module.h>
16#include <linux/hex.h>
17#include <linux/init.h>
18#include <linux/slab.h>
19#include <linux/parser.h>
20#include <linux/string.h>
21#include <linux/err.h>
22#include <linux/overflow.h>
23#include <keys/user-type.h>
24#include <keys/trusted-type.h>
25#include <keys/encrypted-type.h>
26#include <linux/key-type.h>
27#include <linux/random.h>
28#include <linux/rcupdate.h>
29#include <linux/scatterlist.h>
30#include <linux/ctype.h>
31#include <crypto/aes.h>
32#include <crypto/sha2.h>
33#include <crypto/skcipher.h>
34#include <crypto/utils.h>
35
36#include "encrypted.h"
37#include "ecryptfs_format.h"
38
39static const char KEY_TRUSTED_PREFIX[] = "trusted:";
40static const char KEY_USER_PREFIX[] = "user:";
41static const char blkcipher_alg[] = "cbc(aes)";
42static const char key_format_default[] = "default";
43static const char key_format_ecryptfs[] = "ecryptfs";
44static const char key_format_enc32[] = "enc32";
45static unsigned int ivsize;
46static int blksize;
47
48#define KEY_TRUSTED_PREFIX_LEN (sizeof (KEY_TRUSTED_PREFIX) - 1)
49#define KEY_USER_PREFIX_LEN (sizeof (KEY_USER_PREFIX) - 1)
50#define KEY_ECRYPTFS_DESC_LEN 16
51#define HASH_SIZE SHA256_DIGEST_SIZE
52#define MAX_DATA_SIZE 4096
53#define MIN_DATA_SIZE 20
54#define KEY_ENC32_PAYLOAD_LEN 32
55
56enum {
57 Opt_new, Opt_load, Opt_update, Opt_err
58};
59
60enum {
61 Opt_default, Opt_ecryptfs, Opt_enc32, Opt_error
62};
63
64static const match_table_t key_format_tokens = {
65 {Opt_default, "default"},
66 {Opt_ecryptfs, "ecryptfs"},
67 {Opt_enc32, "enc32"},
68 {Opt_error, NULL}
69};
70
71static const match_table_t key_tokens = {
72 {Opt_new, "new"},
73 {Opt_load, "load"},
74 {Opt_update, "update"},
75 {Opt_err, NULL}
76};
77
78static bool user_decrypted_data = IS_ENABLED(CONFIG_USER_DECRYPTED_DATA);
79module_param(user_decrypted_data, bool, 0);
80MODULE_PARM_DESC(user_decrypted_data,
81 "Allow instantiation of encrypted keys using provided decrypted data");
82
83static int aes_get_sizes(void)
84{
85 struct crypto_skcipher *tfm;
86
87 tfm = crypto_alloc_skcipher(blkcipher_alg, 0, CRYPTO_ALG_ASYNC);
88 if (IS_ERR(tfm)) {
89 pr_err("encrypted_key: failed to alloc_cipher (%ld)\n",
90 PTR_ERR(tfm));
91 return PTR_ERR(tfm);
92 }
93 ivsize = crypto_skcipher_ivsize(tfm);
94 blksize = crypto_skcipher_blocksize(tfm);
95 crypto_free_skcipher(tfm);
96 return 0;
97}
98
99/*
100 * valid_ecryptfs_desc - verify the description of a new/loaded encrypted key
101 *
102 * The description of a encrypted key with format 'ecryptfs' must contain
103 * exactly 16 hexadecimal characters.
104 *
105 */
106static int valid_ecryptfs_desc(const char *ecryptfs_desc)
107{
108 int i;
109
110 if (strlen(ecryptfs_desc) != KEY_ECRYPTFS_DESC_LEN) {
111 pr_err("encrypted_key: key description must be %d hexadecimal "
112 "characters long\n", KEY_ECRYPTFS_DESC_LEN);
113 return -EINVAL;
114 }
115
116 for (i = 0; i < KEY_ECRYPTFS_DESC_LEN; i++) {
117 if (!isxdigit(ecryptfs_desc[i])) {
118 pr_err("encrypted_key: key description must contain "
119 "only hexadecimal characters\n");
120 return -EINVAL;
121 }
122 }
123
124 return 0;
125}
126
127/*
128 * valid_master_desc - verify the 'key-type:desc' of a new/updated master-key
129 *
130 * key-type:= "trusted:" | "user:"
131 * desc:= master-key description
132 *
133 * Verify that 'key-type' is valid and that 'desc' exists. On key update,
134 * only the master key description is permitted to change, not the key-type.
135 * The key-type remains constant.
136 *
137 * On success returns 0, otherwise -EINVAL.
138 */
139static int valid_master_desc(const char *new_desc, const char *orig_desc)
140{
141 int prefix_len;
142
143 if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN))
144 prefix_len = KEY_TRUSTED_PREFIX_LEN;
145 else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN))
146 prefix_len = KEY_USER_PREFIX_LEN;
147 else
148 return -EINVAL;
149
150 if (!new_desc[prefix_len])
151 return -EINVAL;
152
153 if (orig_desc && strncmp(new_desc, orig_desc, prefix_len))
154 return -EINVAL;
155
156 return 0;
157}
158
159/*
160 * datablob_parse - parse the keyctl data
161 *
162 * datablob format:
163 * new [<format>] <master-key name> <decrypted data length> [<decrypted data>]
164 * load [<format>] <master-key name> <decrypted data length>
165 * <encrypted iv + data>
166 * update <new-master-key name>
167 *
168 * Tokenizes a copy of the keyctl data, returning a pointer to each token,
169 * which is null terminated.
170 *
171 * On success returns 0, otherwise -EINVAL.
172 */
173static int datablob_parse(char *datablob, const char **format,
174 char **master_desc, char **decrypted_datalen,
175 char **hex_encoded_iv, char **decrypted_data)
176{
177 substring_t args[MAX_OPT_ARGS];
178 int ret = -EINVAL;
179 int key_cmd;
180 int key_format;
181 char *p, *keyword;
182
183 keyword = strsep(&datablob, " \t");
184 if (!keyword) {
185 pr_info("encrypted_key: insufficient parameters specified\n");
186 return ret;
187 }
188 key_cmd = match_token(keyword, key_tokens, args);
189
190 /* Get optional format: default | ecryptfs */
191 p = strsep(&datablob, " \t");
192 if (!p) {
193 pr_err("encrypted_key: insufficient parameters specified\n");
194 return ret;
195 }
196
197 key_format = match_token(p, key_format_tokens, args);
198 switch (key_format) {
199 case Opt_ecryptfs:
200 case Opt_enc32:
201 case Opt_default:
202 *format = p;
203 *master_desc = strsep(&datablob, " \t");
204 break;
205 case Opt_error:
206 *master_desc = p;
207 break;
208 }
209
210 if (!*master_desc) {
211 pr_info("encrypted_key: master key parameter is missing\n");
212 goto out;
213 }
214
215 if (valid_master_desc(*master_desc, NULL) < 0) {
216 pr_info("encrypted_key: master key parameter \'%s\' "
217 "is invalid\n", *master_desc);
218 goto out;
219 }
220
221 if (decrypted_datalen) {
222 *decrypted_datalen = strsep(&datablob, " \t");
223 if (!*decrypted_datalen) {
224 pr_info("encrypted_key: keylen parameter is missing\n");
225 goto out;
226 }
227 }
228
229 switch (key_cmd) {
230 case Opt_new:
231 if (!decrypted_datalen) {
232 pr_info("encrypted_key: keyword \'%s\' not allowed "
233 "when called from .update method\n", keyword);
234 break;
235 }
236 *decrypted_data = strsep(&datablob, " \t");
237 ret = 0;
238 break;
239 case Opt_load:
240 if (!decrypted_datalen) {
241 pr_info("encrypted_key: keyword \'%s\' not allowed "
242 "when called from .update method\n", keyword);
243 break;
244 }
245 *hex_encoded_iv = strsep(&datablob, " \t");
246 if (!*hex_encoded_iv) {
247 pr_info("encrypted_key: hex blob is missing\n");
248 break;
249 }
250 ret = 0;
251 break;
252 case Opt_update:
253 if (decrypted_datalen) {
254 pr_info("encrypted_key: keyword \'%s\' not allowed "
255 "when called from .instantiate method\n",
256 keyword);
257 break;
258 }
259 ret = 0;
260 break;
261 case Opt_err:
262 pr_info("encrypted_key: keyword \'%s\' not recognized\n",
263 keyword);
264 break;
265 }
266out:
267 return ret;
268}
269
270/*
271 * datablob_format - format as an ascii string, before copying to userspace
272 */
273static char *datablob_format(struct encrypted_key_payload *epayload,
274 size_t asciiblob_len)
275{
276 char *ascii_buf, *bufp;
277 u8 *iv = epayload->iv;
278 int len;
279 int i;
280
281 ascii_buf = kmalloc(asciiblob_len + 1, GFP_KERNEL);
282 if (!ascii_buf)
283 goto out;
284
285 ascii_buf[asciiblob_len] = '\0';
286
287 /* copy datablob master_desc and datalen strings */
288 len = sprintf(ascii_buf, "%s %s %s ", epayload->format,
289 epayload->master_desc, epayload->datalen);
290
291 /* convert the hex encoded iv, encrypted-data and HMAC to ascii */
292 bufp = &ascii_buf[len];
293 for (i = 0; i < (asciiblob_len - len) / 2; i++)
294 bufp = hex_byte_pack(bufp, iv[i]);
295out:
296 return ascii_buf;
297}
298
299/*
300 * request_user_key - request the user key
301 *
302 * Use a user provided key to encrypt/decrypt an encrypted-key.
303 */
304static struct key *request_user_key(const char *master_desc, const u8 **master_key,
305 size_t *master_keylen)
306{
307 const struct user_key_payload *upayload;
308 struct key *ukey;
309
310 ukey = request_key(&key_type_user, master_desc, NULL);
311 if (IS_ERR(ukey))
312 goto error;
313
314 down_read(&ukey->sem);
315 upayload = user_key_payload_locked(ukey);
316 if (!upayload) {
317 /* key was revoked before we acquired its semaphore */
318 up_read(&ukey->sem);
319 key_put(ukey);
320 ukey = ERR_PTR(-EKEYREVOKED);
321 goto error;
322 }
323 *master_key = upayload->data;
324 *master_keylen = upayload->datalen;
325error:
326 return ukey;
327}
328
329enum derived_key_type { ENC_KEY, AUTH_KEY };
330
331/* Derive authentication/encryption key from trusted key */
332static int get_derived_key(u8 *derived_key, enum derived_key_type key_type,
333 const u8 *master_key, size_t master_keylen)
334{
335 u8 *derived_buf;
336 unsigned int derived_buf_len;
337
338 derived_buf_len = strlen("AUTH_KEY") + 1 + master_keylen;
339 if (derived_buf_len < HASH_SIZE)
340 derived_buf_len = HASH_SIZE;
341
342 derived_buf = kzalloc(derived_buf_len, GFP_KERNEL);
343 if (!derived_buf)
344 return -ENOMEM;
345
346 if (key_type)
347 strscpy(derived_buf, "AUTH_KEY", HASH_SIZE);
348 else
349 strscpy(derived_buf, "ENC_KEY", HASH_SIZE);
350
351 memcpy(derived_buf + strlen(derived_buf) + 1, master_key,
352 master_keylen);
353 sha256(derived_buf, derived_buf_len, derived_key);
354 kfree_sensitive(derived_buf);
355 return 0;
356}
357
358static struct skcipher_request *init_skcipher_req(const u8 *key,
359 unsigned int key_len)
360{
361 struct skcipher_request *req;
362 struct crypto_skcipher *tfm;
363 int ret;
364
365 tfm = crypto_alloc_skcipher(blkcipher_alg, 0, CRYPTO_ALG_ASYNC);
366 if (IS_ERR(tfm)) {
367 pr_err("encrypted_key: failed to load %s transform (%ld)\n",
368 blkcipher_alg, PTR_ERR(tfm));
369 return ERR_CAST(tfm);
370 }
371
372 ret = crypto_skcipher_setkey(tfm, key, key_len);
373 if (ret < 0) {
374 pr_err("encrypted_key: failed to setkey (%d)\n", ret);
375 crypto_free_skcipher(tfm);
376 return ERR_PTR(ret);
377 }
378
379 req = skcipher_request_alloc(tfm, GFP_KERNEL);
380 if (!req) {
381 pr_err("encrypted_key: failed to allocate request for %s\n",
382 blkcipher_alg);
383 crypto_free_skcipher(tfm);
384 return ERR_PTR(-ENOMEM);
385 }
386
387 skcipher_request_set_callback(req, 0, NULL, NULL);
388 return req;
389}
390
391static struct key *request_master_key(struct encrypted_key_payload *epayload,
392 const u8 **master_key, size_t *master_keylen)
393{
394 struct key *mkey = ERR_PTR(-EINVAL);
395
396 if (!strncmp(epayload->master_desc, KEY_TRUSTED_PREFIX,
397 KEY_TRUSTED_PREFIX_LEN)) {
398 mkey = request_trusted_key(epayload->master_desc +
399 KEY_TRUSTED_PREFIX_LEN,
400 master_key, master_keylen);
401 } else if (!strncmp(epayload->master_desc, KEY_USER_PREFIX,
402 KEY_USER_PREFIX_LEN)) {
403 mkey = request_user_key(epayload->master_desc +
404 KEY_USER_PREFIX_LEN,
405 master_key, master_keylen);
406 } else
407 goto out;
408
409 if (IS_ERR(mkey)) {
410 int ret = PTR_ERR(mkey);
411
412 if (ret == -ENOTSUPP)
413 pr_info("encrypted_key: key %s not supported",
414 epayload->master_desc);
415 else
416 pr_info("encrypted_key: key %s not found",
417 epayload->master_desc);
418 goto out;
419 }
420
421 dump_master_key(*master_key, *master_keylen);
422out:
423 return mkey;
424}
425
426/* Before returning data to userspace, encrypt decrypted data. */
427static int derived_key_encrypt(struct encrypted_key_payload *epayload,
428 const u8 *derived_key,
429 unsigned int derived_keylen)
430{
431 struct scatterlist sg_in[2];
432 struct scatterlist sg_out[1];
433 struct crypto_skcipher *tfm;
434 struct skcipher_request *req;
435 unsigned int encrypted_datalen;
436 u8 iv[AES_BLOCK_SIZE];
437 int ret;
438
439 encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
440
441 req = init_skcipher_req(derived_key, derived_keylen);
442 ret = PTR_ERR(req);
443 if (IS_ERR(req))
444 goto out;
445 dump_decrypted_data(epayload);
446
447 sg_init_table(sg_in, 2);
448 sg_set_buf(&sg_in[0], epayload->decrypted_data,
449 epayload->decrypted_datalen);
450 sg_set_page(&sg_in[1], ZERO_PAGE(0), AES_BLOCK_SIZE, 0);
451
452 sg_init_table(sg_out, 1);
453 sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
454
455 memcpy(iv, epayload->iv, sizeof(iv));
456 skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
457 ret = crypto_skcipher_encrypt(req);
458 tfm = crypto_skcipher_reqtfm(req);
459 skcipher_request_free(req);
460 crypto_free_skcipher(tfm);
461 if (ret < 0)
462 pr_err("encrypted_key: failed to encrypt (%d)\n", ret);
463 else
464 dump_encrypted_data(epayload, encrypted_datalen);
465out:
466 return ret;
467}
468
469static int datablob_hmac_append(struct encrypted_key_payload *epayload,
470 const u8 *master_key, size_t master_keylen)
471{
472 u8 derived_key[HASH_SIZE];
473 u8 *digest;
474 int ret;
475
476 ret = get_derived_key(derived_key, AUTH_KEY, master_key, master_keylen);
477 if (ret < 0)
478 goto out;
479
480 digest = epayload->format + epayload->datablob_len;
481 hmac_sha256_usingrawkey(derived_key, sizeof(derived_key),
482 epayload->format, epayload->datablob_len,
483 digest);
484 dump_hmac(NULL, digest, HASH_SIZE);
485out:
486 memzero_explicit(derived_key, sizeof(derived_key));
487 return ret;
488}
489
490/* verify HMAC before decrypting encrypted key */
491static int datablob_hmac_verify(struct encrypted_key_payload *epayload,
492 const u8 *format, const u8 *master_key,
493 size_t master_keylen)
494{
495 u8 derived_key[HASH_SIZE];
496 u8 digest[HASH_SIZE];
497 int ret;
498 char *p;
499 unsigned short len;
500
501 ret = get_derived_key(derived_key, AUTH_KEY, master_key, master_keylen);
502 if (ret < 0)
503 goto out;
504
505 len = epayload->datablob_len;
506 if (!format) {
507 p = epayload->master_desc;
508 len -= strlen(epayload->format) + 1;
509 } else
510 p = epayload->format;
511
512 hmac_sha256_usingrawkey(derived_key, sizeof(derived_key), p, len,
513 digest);
514 ret = crypto_memneq(digest, epayload->format + epayload->datablob_len,
515 sizeof(digest));
516 if (ret) {
517 ret = -EINVAL;
518 dump_hmac("datablob",
519 epayload->format + epayload->datablob_len,
520 HASH_SIZE);
521 dump_hmac("calc", digest, HASH_SIZE);
522 }
523out:
524 memzero_explicit(derived_key, sizeof(derived_key));
525 return ret;
526}
527
528static int derived_key_decrypt(struct encrypted_key_payload *epayload,
529 const u8 *derived_key,
530 unsigned int derived_keylen)
531{
532 struct scatterlist sg_in[1];
533 struct scatterlist sg_out[2];
534 struct crypto_skcipher *tfm;
535 struct skcipher_request *req;
536 unsigned int encrypted_datalen;
537 u8 iv[AES_BLOCK_SIZE];
538 u8 *pad;
539 int ret;
540
541 /* Throwaway buffer to hold the unused zero padding at the end */
542 pad = kmalloc(AES_BLOCK_SIZE, GFP_KERNEL);
543 if (!pad)
544 return -ENOMEM;
545
546 encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
547 req = init_skcipher_req(derived_key, derived_keylen);
548 ret = PTR_ERR(req);
549 if (IS_ERR(req))
550 goto out;
551 dump_encrypted_data(epayload, encrypted_datalen);
552
553 sg_init_table(sg_in, 1);
554 sg_init_table(sg_out, 2);
555 sg_set_buf(sg_in, epayload->encrypted_data, encrypted_datalen);
556 sg_set_buf(&sg_out[0], epayload->decrypted_data,
557 epayload->decrypted_datalen);
558 sg_set_buf(&sg_out[1], pad, AES_BLOCK_SIZE);
559
560 memcpy(iv, epayload->iv, sizeof(iv));
561 skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
562 ret = crypto_skcipher_decrypt(req);
563 tfm = crypto_skcipher_reqtfm(req);
564 skcipher_request_free(req);
565 crypto_free_skcipher(tfm);
566 if (ret < 0)
567 goto out;
568 dump_decrypted_data(epayload);
569out:
570 kfree(pad);
571 return ret;
572}
573
574/* Allocate memory for decrypted key and datablob. */
575static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
576 const char *format,
577 const char *master_desc,
578 const char *datalen,
579 const char *decrypted_data)
580{
581 struct encrypted_key_payload *epayload = NULL;
582 unsigned short datablob_len;
583 unsigned short payload_totallen;
584 unsigned short decrypted_datalen;
585 unsigned short payload_datalen;
586 unsigned int encrypted_datalen;
587 unsigned int format_len;
588 long dlen;
589 int i;
590 int ret;
591
592 ret = kstrtol(datalen, 10, &dlen);
593 if (ret < 0 || dlen < MIN_DATA_SIZE || dlen > MAX_DATA_SIZE)
594 return ERR_PTR(-EINVAL);
595
596 format_len = (!format) ? strlen(key_format_default) : strlen(format);
597 decrypted_datalen = dlen;
598 payload_datalen = decrypted_datalen;
599
600 if (decrypted_data) {
601 if (!user_decrypted_data) {
602 pr_err("encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false\n");
603 return ERR_PTR(-EINVAL);
604 }
605 if (strlen(decrypted_data) != decrypted_datalen * 2) {
606 pr_err("encrypted key: decrypted data provided does not match decrypted data length provided\n");
607 return ERR_PTR(-EINVAL);
608 }
609 for (i = 0; i < strlen(decrypted_data); i++) {
610 if (!isxdigit(decrypted_data[i])) {
611 pr_err("encrypted key: decrypted data provided must contain only hexadecimal characters\n");
612 return ERR_PTR(-EINVAL);
613 }
614 }
615 }
616
617 if (format) {
618 if (!strcmp(format, key_format_ecryptfs)) {
619 if (dlen != ECRYPTFS_MAX_KEY_BYTES) {
620 pr_err("encrypted_key: keylen for the ecryptfs format must be equal to %d bytes\n",
621 ECRYPTFS_MAX_KEY_BYTES);
622 return ERR_PTR(-EINVAL);
623 }
624 decrypted_datalen = ECRYPTFS_MAX_KEY_BYTES;
625 payload_datalen = sizeof(struct ecryptfs_auth_tok);
626 } else if (!strcmp(format, key_format_enc32)) {
627 if (decrypted_datalen != KEY_ENC32_PAYLOAD_LEN) {
628 pr_err("encrypted_key: enc32 key payload incorrect length: %d\n",
629 decrypted_datalen);
630 return ERR_PTR(-EINVAL);
631 }
632 }
633 }
634
635 encrypted_datalen = roundup(decrypted_datalen, blksize);
636
637 if (check_add_overflow(format_len + 1 + strlen(master_desc) + 1
638 + strlen(datalen) + 1 + ivsize + 1,
639 encrypted_datalen, &datablob_len))
640 return ERR_PTR(-EINVAL);
641
642 if (check_add_overflow(datablob_len,
643 payload_datalen + HASH_SIZE + 1,
644 &payload_totallen))
645 return ERR_PTR(-EINVAL);
646
647 ret = key_payload_reserve(key, payload_totallen);
648 if (ret < 0)
649 return ERR_PTR(ret);
650
651 epayload = kzalloc_flex(*epayload, payload_data, payload_totallen,
652 GFP_KERNEL);
653 if (!epayload)
654 return ERR_PTR(-ENOMEM);
655
656 epayload->payload_datalen = payload_datalen;
657 epayload->decrypted_datalen = decrypted_datalen;
658 epayload->datablob_len = datablob_len;
659 return epayload;
660}
661
662static int encrypted_key_decrypt(struct encrypted_key_payload *epayload,
663 const char *format, const char *hex_encoded_iv)
664{
665 struct key *mkey;
666 u8 derived_key[HASH_SIZE];
667 const u8 *master_key;
668 u8 *hmac;
669 const char *hex_encoded_data;
670 unsigned int encrypted_datalen;
671 size_t master_keylen;
672 size_t asciilen;
673 int ret;
674
675 encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
676 asciilen = (ivsize + 1 + encrypted_datalen + HASH_SIZE) * 2;
677 if (strlen(hex_encoded_iv) != asciilen)
678 return -EINVAL;
679
680 hex_encoded_data = hex_encoded_iv + (2 * ivsize) + 2;
681 ret = hex2bin(epayload->iv, hex_encoded_iv, ivsize);
682 if (ret < 0)
683 return -EINVAL;
684 ret = hex2bin(epayload->encrypted_data, hex_encoded_data,
685 encrypted_datalen);
686 if (ret < 0)
687 return -EINVAL;
688
689 hmac = epayload->format + epayload->datablob_len;
690 ret = hex2bin(hmac, hex_encoded_data + (encrypted_datalen * 2),
691 HASH_SIZE);
692 if (ret < 0)
693 return -EINVAL;
694
695 mkey = request_master_key(epayload, &master_key, &master_keylen);
696 if (IS_ERR(mkey))
697 return PTR_ERR(mkey);
698
699 ret = datablob_hmac_verify(epayload, format, master_key, master_keylen);
700 if (ret < 0) {
701 pr_err("encrypted_key: bad hmac (%d)\n", ret);
702 goto out;
703 }
704
705 ret = get_derived_key(derived_key, ENC_KEY, master_key, master_keylen);
706 if (ret < 0)
707 goto out;
708
709 ret = derived_key_decrypt(epayload, derived_key, sizeof derived_key);
710 if (ret < 0)
711 pr_err("encrypted_key: failed to decrypt key (%d)\n", ret);
712out:
713 up_read(&mkey->sem);
714 key_put(mkey);
715 memzero_explicit(derived_key, sizeof(derived_key));
716 return ret;
717}
718
719static void __ekey_init(struct encrypted_key_payload *epayload,
720 const char *format, const char *master_desc,
721 const char *datalen)
722{
723 unsigned int format_len;
724
725 format_len = (!format) ? strlen(key_format_default) : strlen(format);
726 epayload->format = epayload->payload_data + epayload->payload_datalen;
727 epayload->master_desc = epayload->format + format_len + 1;
728 epayload->datalen = epayload->master_desc + strlen(master_desc) + 1;
729 epayload->iv = epayload->datalen + strlen(datalen) + 1;
730 epayload->encrypted_data = epayload->iv + ivsize + 1;
731 epayload->decrypted_data = epayload->payload_data;
732
733 if (!format)
734 memcpy(epayload->format, key_format_default, format_len);
735 else {
736 if (!strcmp(format, key_format_ecryptfs))
737 epayload->decrypted_data =
738 ecryptfs_get_auth_tok_key((struct ecryptfs_auth_tok *)epayload->payload_data);
739
740 memcpy(epayload->format, format, format_len);
741 }
742
743 memcpy(epayload->master_desc, master_desc, strlen(master_desc));
744 memcpy(epayload->datalen, datalen, strlen(datalen));
745}
746
747/*
748 * encrypted_init - initialize an encrypted key
749 *
750 * For a new key, use either a random number or user-provided decrypted data in
751 * case it is provided. A random number is used for the iv in both cases. For
752 * an old key, decrypt the hex encoded data.
753 */
754static int encrypted_init(struct encrypted_key_payload *epayload,
755 const char *key_desc, const char *format,
756 const char *master_desc, const char *datalen,
757 const char *hex_encoded_iv, const char *decrypted_data)
758{
759 int ret = 0;
760
761 if (format && !strcmp(format, key_format_ecryptfs)) {
762 ret = valid_ecryptfs_desc(key_desc);
763 if (ret < 0)
764 return ret;
765
766 ecryptfs_fill_auth_tok((struct ecryptfs_auth_tok *)epayload->payload_data,
767 key_desc);
768 }
769
770 __ekey_init(epayload, format, master_desc, datalen);
771 if (hex_encoded_iv) {
772 ret = encrypted_key_decrypt(epayload, format, hex_encoded_iv);
773 } else if (decrypted_data) {
774 get_random_bytes(epayload->iv, ivsize);
775 ret = hex2bin(epayload->decrypted_data, decrypted_data,
776 epayload->decrypted_datalen);
777 } else {
778 get_random_bytes(epayload->iv, ivsize);
779 get_random_bytes(epayload->decrypted_data, epayload->decrypted_datalen);
780 }
781 return ret;
782}
783
784/*
785 * encrypted_instantiate - instantiate an encrypted key
786 *
787 * Instantiates the key:
788 * - by decrypting an existing encrypted datablob, or
789 * - by creating a new encrypted key based on a kernel random number, or
790 * - using provided decrypted data.
791 *
792 * On success, return 0. Otherwise return errno.
793 */
794static int encrypted_instantiate(struct key *key,
795 struct key_preparsed_payload *prep)
796{
797 struct encrypted_key_payload *epayload = NULL;
798 char *datablob = NULL;
799 const char *format = NULL;
800 char *master_desc = NULL;
801 char *decrypted_datalen = NULL;
802 char *hex_encoded_iv = NULL;
803 char *decrypted_data = NULL;
804 size_t datalen = prep->datalen;
805 int ret;
806
807 if (datalen == 0 || datalen > 32767 || !prep->data)
808 return -EINVAL;
809
810 datablob = kmalloc(datalen + 1, GFP_KERNEL);
811 if (!datablob)
812 return -ENOMEM;
813 datablob[datalen] = 0;
814 memcpy(datablob, prep->data, datalen);
815 ret = datablob_parse(datablob, &format, &master_desc,
816 &decrypted_datalen, &hex_encoded_iv, &decrypted_data);
817 if (ret < 0)
818 goto out;
819
820 epayload = encrypted_key_alloc(key, format, master_desc,
821 decrypted_datalen, decrypted_data);
822 if (IS_ERR(epayload)) {
823 ret = PTR_ERR(epayload);
824 goto out;
825 }
826 ret = encrypted_init(epayload, key->description, format, master_desc,
827 decrypted_datalen, hex_encoded_iv, decrypted_data);
828 if (ret < 0) {
829 kfree_sensitive(epayload);
830 goto out;
831 }
832
833 rcu_assign_keypointer(key, epayload);
834out:
835 kfree_sensitive(datablob);
836 return ret;
837}
838
839static void encrypted_rcu_free(struct rcu_head *rcu)
840{
841 struct encrypted_key_payload *epayload;
842
843 epayload = container_of(rcu, struct encrypted_key_payload, rcu);
844 kfree_sensitive(epayload);
845}
846
847/*
848 * encrypted_update - update the master key description
849 *
850 * Change the master key description for an existing encrypted key.
851 * The next read will return an encrypted datablob using the new
852 * master key description.
853 *
854 * On success, return 0. Otherwise return errno.
855 */
856static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
857{
858 struct encrypted_key_payload *epayload = key->payload.data[0];
859 struct encrypted_key_payload *new_epayload;
860 char *buf;
861 char *new_master_desc = NULL;
862 const char *format = NULL;
863 size_t datalen = prep->datalen;
864 int ret = 0;
865
866 if (key_is_negative(key))
867 return -ENOKEY;
868 if (datalen == 0 || datalen > 32767 || !prep->data)
869 return -EINVAL;
870
871 buf = kmalloc(datalen + 1, GFP_KERNEL);
872 if (!buf)
873 return -ENOMEM;
874
875 buf[datalen] = 0;
876 memcpy(buf, prep->data, datalen);
877 ret = datablob_parse(buf, &format, &new_master_desc, NULL, NULL, NULL);
878 if (ret < 0)
879 goto out;
880
881 ret = valid_master_desc(new_master_desc, epayload->master_desc);
882 if (ret < 0)
883 goto out;
884
885 new_epayload = encrypted_key_alloc(key, epayload->format,
886 new_master_desc, epayload->datalen, NULL);
887 if (IS_ERR(new_epayload)) {
888 ret = PTR_ERR(new_epayload);
889 goto out;
890 }
891
892 __ekey_init(new_epayload, epayload->format, new_master_desc,
893 epayload->datalen);
894
895 memcpy(new_epayload->iv, epayload->iv, ivsize);
896 memcpy(new_epayload->payload_data, epayload->payload_data,
897 epayload->payload_datalen);
898
899 rcu_assign_keypointer(key, new_epayload);
900 call_rcu(&epayload->rcu, encrypted_rcu_free);
901out:
902 kfree_sensitive(buf);
903 return ret;
904}
905
906/*
907 * encrypted_read - format and copy out the encrypted data
908 *
909 * The resulting datablob format is:
910 * <master-key name> <decrypted data length> <encrypted iv> <encrypted data>
911 *
912 * On success, return to userspace the encrypted key datablob size.
913 */
914static long encrypted_read(const struct key *key, char *buffer,
915 size_t buflen)
916{
917 struct encrypted_key_payload *epayload;
918 struct key *mkey;
919 const u8 *master_key;
920 size_t master_keylen;
921 char derived_key[HASH_SIZE];
922 char *ascii_buf;
923 size_t asciiblob_len;
924 int ret;
925
926 epayload = dereference_key_locked(key);
927
928 /* returns the hex encoded iv, encrypted-data, and hmac as ascii */
929 asciiblob_len = epayload->datablob_len + ivsize + 1
930 + roundup(epayload->decrypted_datalen, blksize)
931 + (HASH_SIZE * 2);
932
933 if (!buffer || buflen < asciiblob_len)
934 return asciiblob_len;
935
936 mkey = request_master_key(epayload, &master_key, &master_keylen);
937 if (IS_ERR(mkey))
938 return PTR_ERR(mkey);
939
940 ret = get_derived_key(derived_key, ENC_KEY, master_key, master_keylen);
941 if (ret < 0)
942 goto out;
943
944 ret = derived_key_encrypt(epayload, derived_key, sizeof derived_key);
945 if (ret < 0)
946 goto out;
947
948 ret = datablob_hmac_append(epayload, master_key, master_keylen);
949 if (ret < 0)
950 goto out;
951
952 ascii_buf = datablob_format(epayload, asciiblob_len);
953 if (!ascii_buf) {
954 ret = -ENOMEM;
955 goto out;
956 }
957
958 up_read(&mkey->sem);
959 key_put(mkey);
960 memzero_explicit(derived_key, sizeof(derived_key));
961
962 memcpy(buffer, ascii_buf, asciiblob_len);
963 kfree_sensitive(ascii_buf);
964
965 return asciiblob_len;
966out:
967 up_read(&mkey->sem);
968 key_put(mkey);
969 memzero_explicit(derived_key, sizeof(derived_key));
970 return ret;
971}
972
973/*
974 * encrypted_destroy - clear and free the key's payload
975 */
976static void encrypted_destroy(struct key *key)
977{
978 kfree_sensitive(key->payload.data[0]);
979}
980
981struct key_type key_type_encrypted = {
982 .name = "encrypted",
983 .instantiate = encrypted_instantiate,
984 .update = encrypted_update,
985 .destroy = encrypted_destroy,
986 .describe = user_describe,
987 .read = encrypted_read,
988};
989EXPORT_SYMBOL_GPL(key_type_encrypted);
990
991static int __init init_encrypted(void)
992{
993 int ret;
994
995 ret = aes_get_sizes();
996 if (ret < 0)
997 return ret;
998 return register_key_type(&key_type_encrypted);
999}
1000
1001static void __exit cleanup_encrypted(void)
1002{
1003 unregister_key_type(&key_type_encrypted);
1004}
1005
1006late_initcall(init_encrypted);
1007module_exit(cleanup_encrypted);
1008
1009MODULE_DESCRIPTION("Encrypted key type");
1010MODULE_LICENSE("GPL");